<p>Could some one please help me with this..
I would like to understand a bit about the apiGroups &amp; its usage in below Role definition.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: example.com-superuser  
rules:
- apiGroups: [&quot;example.com&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
</code></pre>
<p>I was going through RBAC in Kubernetes. <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a>
Above example is from this link.</p>

bala sreekanth
<p>An api group groups a set of resource types in a common namespace. For example, resource types related to Ingress services are grouped under the <code>networking.k8s.io</code> api group:</p>
<pre><code>$ kubectl api-resources --api-group newtorking.k8s.io
NAME              SHORTNAMES   APIVERSION             NAMESPACED   KIND
ingressclasses                 networking.k8s.io/v1   false        IngressClass
ingresses         ing          networking.k8s.io/v1   true         Ingress
networkpolicies   netpol       networking.k8s.io/v1   true         NetworkPolicy
</code></pre>
<p>It is possible to have two different resource types that have the same short name in different resource groups. For example, in my OpenShift system there are two different groups that provide a <code>Subscription</code> resource type:</p>
<pre><code>$ kubectl api-resources | awk '$NF == &quot;Subscription&quot; {print}'
subscriptions                         appsub                                 apps.open-cluster-management.io/v1                 true         Subscription
subscriptions                         sub,subs                               operators.coreos.com/v1alpha1                      true         Subscription
</code></pre>
<p>If I am creating a role, I need to specify to <em>which</em> <code>Subscription</code> I want to grant access. This:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: allow-config-access
rules:
- apiGroups:
    - operators.coreos.com
  resources:
    - subscriptions
  verbs: [&quot;*&quot;]
</code></pre>
<p>Provides access to different resources than this:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: allow-config-access
rules:
- apiGroups:
    - apps.open-cluster-management.io
  resources:
    - subscriptions
  verbs: [&quot;*&quot;]
</code></pre>
