<p>I am trying to give service account permissions to run <code>kubectl apply -f somerole.yaml</code> on an <strong>existing role</strong>.  </p>

<p>I created a service account with the following permissions:  </p>

<pre><code>cat &gt; ~/tmp/Role.yaml &lt;&lt;EOF 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  namespace: default
  name: my-role6
rules: 
- apiGroups: ["*"]
  resources: ["roles"]
  verbs: ["replace", "patch", "get", "list", "create"] 
EOF

kubectl create -f ~/tmp/Role.yaml  
</code></pre>

<p>All the background permissions (RoleBinding, context) seems to be good because if I add <code>pods</code> in the resources field I can use:<br>
<code>kubectl get pods --context=myservice6-context</code>  </p>

<p>When I run:  </p>

<pre><code>kubectl apply -f malrole.yaml --context=$CONTEXT_NAME
</code></pre>

<p>I received:  </p>

<pre><code>Error from server (Forbidden): error when creating "malrole.yaml": roles.rbac.authorization.k8s.io "testrole" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["pods"], APIGroups:["*"], Verbs:["get"]}] user=&amp;{system:serviceaccount:default:myservice6 5cdb719b-828b-11e8-993e-02420d415928 [system:serviceaccounts system:serviceaccounts:default system:authenticated] map[]} ownerrules=[PolicyRule{Resources:["selfsubjectaccessreviews"], APIGroups:["authorization.k8s.io"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*""/version"], Verbs:["get"]} PolicyRule{Resources:["roles"], APIGroups:["*"], Verbs:["replace" "patch" "get" "list" "create"]}] ruleResolutionErrors=[]
</code></pre>

<p>More readable version:  </p>

<pre><code>Error from server (Forbidden): 
    error when creating "malrole.yaml": 
    roles.rbac.authorization.k8s.io "testrole" is forbidden: 
        attempt to grant extra privileges: 
        [ 
            PolicyRule{
                Resources:["pods"], APIGroups:["*"], Verbs:["get"]
            }
        ] 
        user=&amp;{
            system:serviceaccount:default:myservice6 5cdb719b-828b-11e8-993e-02420d415928 
            [system:serviceaccounts system:serviceaccounts:default system:authenticated] map[]
            } 

        ownerrules=[
            PolicyRule{
                Resources:["selfsubjectaccessreviews"], APIGroups:["authorization.k8s.io"], 
                Verbs:["create"]
            } 

            PolicyRule{
                NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*""/version"], 
                Verbs:["get"]
            }

            PolicyRule{
                Resources:["roles"], APIGroups:["*"], Verbs:["replace" "patch" "get" "list" "create"]
            }
        ] 


        ruleResolutionErrors=[]
</code></pre>

<p>malrole.yaml (the file I tried to apply):  </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: default
  name: testrole
rules:
- apiGroups: ["*"]
  resources: ["pods"]
  verbs: ["get"]
</code></pre>

<p>It writes:  </p>

<blockquote>
  <p>An attemp to grant extra privileges...  </p>
</blockquote>

<p>Which is taken from this line in the code:<br>
<a href="https://github.com/kubernetes/kubernetes/blob/4d9873556201f2766ccf6161f7beac5f76b8fd60/pkg/registry/rbac/validation/rule.go#L52" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/blob/4d9873556201f2766ccf6161f7beac5f76b8fd60/pkg/registry/rbac/validation/rule.go#L52</a></p>

<p>Not sure why.  </p>

<p>According to the documentation:  </p>

<blockquote>
  <p>ConfirmNoEscalation determines <strong>if the roles for a given user</strong> in a
  given namespace <strong>encompass</strong> the <strong>provided role</strong>.</p>
</blockquote>

<p>But I tried also give myself more permissions (see in the edit) and I still received this error.  </p>

<p><strong>EDIT:</strong><br>
even when I change the permissions to  </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  namespace: default
  name: my-role6
rules: 
- apiGroups: ["*"]
  resources: ["roles"]
  verbs: ["*"] 
</code></pre>

<p>I received:  </p>

<pre><code>Error from server (Forbidden): error when applying patch:
{"metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"rbac.authorization.k8s.io/v1beta1\",\"kind\":\"Role\",\"metadata\":{\"annotations\":{},\"name\":\"testrole\",\"namespace\":\"default\"},\"rules\":[{\"apiGroups\":[\"*\"],\"resources\":[\"pods\"],\"verbs\":[\"list\",\"get\"]}]}\n"}},"rules":[{"apiGroups":["*"],"resources":["pods"],"verbs":["list","get"]}]}
to:
&amp;{0xc420b26840 0xc4202b18f0 default testrole malrole.yaml 0xc4211a8988 0xc42000c008 1638 false}
for: "malrole.yaml": roles.rbac.authorization.k8s.io "testrole" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["pods"], APIGroups:["*"], Verbs:["list"]} PolicyRule{Resources:["pods"], APIGroups:["*"], Verbs:["get"]}] user=&amp;{system:serviceaccount:default:myservice6 5cdb719b-828b-11e8-993e-02420d415928 [system:serviceaccounts system:serviceaccounts:default system:authenticated] map[]} ownerrules=[PolicyRule{Resources:["selfsubjectaccessreviews"], APIGroups:["authorization.k8s.io"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]} PolicyRule{Resources:["roles"], APIGroups:["*"], Verbs:["*"]}] ruleResolutionErrors=[]
</code></pre>

E235
<p>@liggitt told me that </p>

<blockquote>
  <p>Escalation prevention rejects attempts to create roles containing
  permissions you do not already possess</p>
</blockquote>

<p>Following:<br>
<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping</a>  </p>

<p>I found that in order to be able to apply roles I need to have the following permissions:  </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  namespace: default
  name: $ROLE_NAME
rules: 
- apiGroups: ["*"]
  resources: ["roles", "pods"]
  verbs: ["patch", "get", "list"] 
</code></pre>

<p>I am not sure why <code>pods</code> should be part of the resource when I am just applying a roles.  But maybe the applying is using some system pod for that.  </p>

<p>As it was mentioned in the above link:  </p>

<blockquote>
  <p>To allow a user to create/update roles:</p>
  
  <ol>
  <li>Grant them a role that allows them to create/update Role or
  ClusterRole objects, as desired.   </li>
  <li>Grant them roles <strong>containing</strong> the
  <strong>permissions you would want them to be able to set in a Role or
  ClusterRole.</strong> If they attempt to create or modify a Role or ClusterRole
  with permissions they themselves have not been granted, the API
  request will be forbidden.</li>
  </ol>
</blockquote>
