<p>I am learning rbac to do access control, here is my role definition:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: foobar-role
  labels:
    # Add these permissions to the "view" default role.
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "patch"]
</code></pre>

<p>the role allow a subject to access secret, but I wonder is it possible to limit access to a specific path:   </p>

<pre><code>apiVersion: v1
data:
  keycloak.clientSecret: ...
  keycloak.url: ...
  user.password: ...
kind: Secret
metadata:
  creationTimestamp: "2019-04-21T08:07:21Z"
  labels:
    app: foobar-ce
    heritage: Tiller
    release: foobar
  name: foobar-secret
  namespace: default
  resourceVersion: "12348"
  selfLink: /api/v1/namespaces/default/secrets/foobar-secret
  uid: 7d8775d9-640c-11e9-8327-0242b821d21a
type: Opaque
</code></pre>

<p>For example, is it possible to change the role only is able to</p>

<ul>
<li>view <code>{.data.keycloak\.url}</code> (read-only)</li>
<li>update <code>{.data.keycloak\.clientSecret}</code> (write-only)</li>
</ul>

qrtt1
<p>You can limit to a single resource (<code>resourceNames</code> in the policy), but not beyond that. I don't think the API even supports partial access.</p>
