<p>I need to grant access to one deployment and all pods of this deployment using RBAC.
I've managed to configure <code>Role</code> and <code>RoleBinding</code> for the <code>deploymet</code>, and it's working fine:</p>

<pre><code>---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: &lt;my-namespace&gt;
  name: &lt;deployment&gt;-manager-role
rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["deployments"]
    resourceNames: ["&lt;deployment&gt;"]
    verbs: ["get", "list", "watch", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: &lt;deployment&gt;-manager-binding
  namespace: &lt;my-namespace&gt;
subjects:
  - kind: User
    name: &lt;username&gt;
    apiGroup: ""
roleRef:
  kind: Role
  name: &lt;deployment&gt;-manager-role
  apiGroup: ""
</code></pre>

<p>Using this role user can access, update and patch the deployment. This deployment creates pods with dynamic names (like <code>&lt;deployment&gt;-5594cbfcf4-v4xx8</code>). I tried to allow this user to access these pods (get, list, watch, read logs, exec, delete) using deployment name and using deployment name + wildcard char <code>*</code>:</p>

<pre><code>---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: &lt;my-namespace&gt;
  name: &lt;deployment&gt;-pods-manager-role
rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["pods"]
    resourceNames: ["&lt;deployment&gt;*"]
    verbs: ["get", "list", "watch", "update", "patch", "exec", "delete"]
</code></pre>

<p>I also updated the role binding. But when I try to get the pod:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl --context=&lt;username&gt;-ctx -n &lt;namespace&gt; get pods &lt;deployment&gt;-5594cbfcf4-v4xx8
</code></pre>

<p>I'm getting error:</p>

<blockquote>
  <p>Error from server (Forbidden): pods "&lt;deployment&gt;-5594cbfcf4-v4xx8" is forbidden: User "&lt;username&gt;" cannot get resource "pods" in API group "" in the namespace "&lt;namespace&gt;"</p>
</blockquote>

<p>If I add <code>&lt;deployment&gt;-5594cbfcf4-v4xx8</code> to the list of <code>resourceNames</code>, user can access this pod.</p>

<p>Is it possible to grant access to the specific pods based on deployment name?</p>

Kirill
<p>In Kubernetes, pods are considered as an ephemeral "cattle", they come and go. You shouldn't try to manage RBAC per pod.</p>

<p>In your use case, there is unfortunately no way to grant a role over a set of pods matching a certain name, because the <code>resourceNames</code> field <strong>doesn't support patterns like prefixes/suffixes</strong>. Don't get confused: a single asterisk character (<code>'*'</code>) has a special meaning that means "all", but it's not a pattern. So, <code>'my-app-*</code> in resourceNames will not work. There were tickets opened for this feature, but it wasn't implemented:<br>
<a href="https://github.com/kubernetes/kubernetes/issues/56582" rel="noreferrer">https://github.com/kubernetes/kubernetes/issues/56582</a></p>

<p>There was also a request to be able to manage RBAC over labels, but that feature isn't implemented neither:<br>
<a href="https://github.com/kubernetes/kubernetes/issues/44703" rel="noreferrer">https://github.com/kubernetes/kubernetes/issues/44703</a></p>

<p>Therefore, you probably need to change your model to grant roles to users to manage all pods in a certain namespace. Your deployment should be the only "source of pods" in that namespace. That way, you will not need to specify any resource names.</p>
