<p>Here is the output when checking the detail of a specific cluster role. what do Non-Resource URLs and Resource Names mean in the result?</p>
<pre><code>controlplane ~ kubectl describe clusterrole node-admin

Name:         node-admin
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  nodes      []                 []              [get watch list create delete]
</code></pre>

Ryan Lyu
<p>From the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#policyrule-v1-rbac-authorization-k8s-io" rel="nofollow noreferrer">API docs</a></p>
<blockquote>
<p><strong>NonResourceURLs</strong> is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as &quot;pods&quot; or &quot;secrets&quot;) or non-resource URL paths (such as &quot;/api&quot;), but not both.</p>
</blockquote>
<p>ClusterRoles are about giving permissions to some subjects to do some things. Usually those things involve interacting with RESTful resources like Pods, Services, other built-in resources, or custom resources coming from CustomResourceDefinitions. But there are other URLs not related to resources that you might want to control access to. The docs give <code>/healthz</code> as an example endpoint:</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-examples" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-examples</a></p>
<blockquote>
<p><strong>ResourceNames</strong> is an optional white list of names that the rule applies to. An empty set means that everything is allowed.</p>
</blockquote>
<p>As previously mentioned, usually ClusterRoles are about giving permissions to do stuff with resources. Normally, when you name a type of resource, the allowed verbs apply to all resources of that type. So if you allow deletion on the <code>pods</code> resources, the ClusterRole allows deletion of all pods. However, maybe you only want to allow deletion of specific pods, say one called <code>nginx-0</code>. You would put that name in the <code>ResourceNames</code> list.</p>
