title: How to refer to all subresources in a Role definition?
body: <p>Here's a simple Kubernetes role:</p>
  
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: Role
  metadata:
    name: temp-role
    namespace: stackoverflow
  rules:
  - apiGroups: [""]
    resources:
    - pods
    verbs:
    - get
  </code></pre>
  
  <p>This role allows me to say <code>kubectl get pod foobar</code> and I can get the pod.</p>
  
  <p>However, I cannot get the pod logs now:</p>
  
  <pre><code>Error from server (Forbidden): pods "foobar" is forbidden: User "system:serviceaccount:kube-system:myuser" cannot get resource "pods/log" in API group "" in the namespace "stackoverflow"
  </code></pre>
  
  <p>So the error tells me there's a separate sub-resource <code>pods/log</code> that I need to mention explicitly in my resources. </p>
  
  <p>Interestingly <code>kubectl auth can-i</code> lies to me:</p>
  
  <pre><code>$ kubectl -n stackoverflow auth can-i get pods/log                                                                           
  yes
  </code></pre>
  
  <p>Okay let's fix this and menetion the subresource directly:</p>
  
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: Role
  metadata:
    name: temp-role
    namespace: stackoverflow
  rules:
  - apiGroups: [""]
    resources:
    - pods
    - pods/log
    verbs:
    - get
  </code></pre>
  
  <p>Now I can retrieve logs properly!</p>
  
  <hr>
  
  <h2>So what's the problem</h2>
  
  <p>Thing is, I'm trying to create a <code>ClusterRole</code> with read/write access to some specific resources (subset of <code>edit</code> ClusterRole, specifically), and I had hoped I can accomplish it by using <code>kubectl api-resources</code> and allowing everything from there, except the few things I don't want to allow.</p>
  
  <p>But subresources like <code>pods/log</code> don't appear on the list, so this approach doesn't work - I'd block access to some things I intend to expose, but I don't even know what exactly. I only learned about <code>pods/log</code> after I tried it and noticed it doesn't work.</p>
  
  <p>So I'm looking for a way to either:</p>
  
  <ul>
  <li>mention a resource with all sub-resources in <code>rules.resources</code> (I tried <code>pods/*</code> but it didn't seem to do anything)</li>
  <li>if the above is not possible: get a list of all resources <em>and sub-resources</em>, so that I can whitelist them all in <code>rules.resources</code> individually.</li>
  </ul>
  
  <p>Thoughts?</p>