<p>I granted read access to pod</p>
<p>Sample:</p>
<pre><code>kubectl create serviceaccount sa1 

kubectl create role pod-reader --verb=get --resource=pods

kubectl create rolebinding sa1-binding --serviceaccount=default:sa1 --role=pod-reader 
</code></pre>
<p>Is there any way to restrict this access to selected pods on the basis of metadata or labels?</p>

Dev
<p>As discussed in the comments, you can use <code>resourceNames</code> to provide access to selected resources.</p>
<p>Here is an excerpt from k8s <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources" rel="nofollow noreferrer">docs</a>.</p>
<p>Example,</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: configmap-updater
rules:
- apiGroups: [&quot;&quot;]
  #
  # at the HTTP level, the name of the resource for accessing ConfigMap
  # objects is &quot;configmaps&quot;
  resources: [&quot;configmaps&quot;]
  resourceNames: [&quot;my-configmap&quot;]
  verbs: [&quot;update&quot;, &quot;get&quot;]
</code></pre>
<blockquote>
<p>Also, You cannot restrict create or deletecollection requests by resourceName. For create, this limitation is because the object name is not known at authorization time.</p>
</blockquote>
