<p>I’ve a go program which need to access to config map,  when using the following clusterRole we got error forbidden</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: s-access
 labels:
  app.kubernetes.io/instance: te-mger
rules:
 - verbs:
   - get
   - watch
   - list
   - update
  apiGroups:
   - dpt.com
  resources:
   - pods
</code></pre>
<p>Now when I change it to the following it works, (adding apiGroups '') and <code>configmaps</code> to the <code>resources</code>
As this is a workaround what should we do for long solutions</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: s-access
 labels:
  app.kubernetes.io/instance: te-mger
rules:
 - verbs:
   - get
   - watch
   - list
   - update
  apiGroups:
   - dpt.com
   - ''
  resources:
   - pods
   - configmaps
</code></pre>
<p>I read the following but it didnt help <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a></p>
<p>I want to <strong>avoid</strong> using <strong>apiGroups: ''</strong></p>

Jenney
<p>Each Kubernetes resource is part of some API group. The API group defines the path on which these resources are available.  You can find them for example in the Kubernetes API reference (for each resource you have the group, version and kind).</p>
<p>As you can see <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#configmap-v1-core" rel="noreferrer">here</a>, for example for ConfigMap the group is <code>core</code>. The group into which the resource belongs needs to be used in the ClusterRole (or Role) when referencing the resources. That is needed to properly specify which resource you are talking about since the resource name is not necessarily unique on its own but only in combination with the group.</p>
<p>Normally, the group is just written there, but for the <code>core</code> group, you normally just put there <code>&quot;&quot;</code> (as described <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-example" rel="noreferrer">here</a>).</p>
<p>So in your examples, this:</p>
<pre class="lang-yaml prettyprint-override"><code>rules:
  - verbs:
      - get
      - watch
      - list
      - update
    apiGroups:
      - dpt.com
    resources:
      - configmaps
</code></pre>
<p>would cover some resources named <code>pod</code> and <code>configmap</code> from your own API group <code>dsp.com</code> but not the real Kubernetes resources from the <code>core</code> group. To cover them you need to specify the right group like this:</p>
<pre class="lang-yaml prettyprint-override"><code>rules:
  - verbs:
      - get
      - watch
      - list
      - update
    apiGroups:
      - &quot;&quot;
    resources:
      - configmaps
</code></pre>
<p>If you would want to give access only to specific ConfigMap, you can use the <code>resourceNames</code> field.</p>
<pre class="lang-yaml prettyprint-override"><code>rules:
  - verbs:
      - get
      - watch
      - list
      - update
    apiGroups:
      - &quot;&quot;
    resources:
      - configmaps
    resourceNames:
      - my-config-map
      - my-config-map
</code></pre>
<p>But you need to name the config maps one by one. It does not support any wildcards, regular expressions or anything.</p>
