title: Proper use of Role.rules.resourceNames for creating pods with limited access to resources
body: <p>I am trying to create a Pod that is able to create and update a specific configmap using <code>Role.rules.resourceNames</code>. I am able to perform a get request for the resource to the API from within the pod, but I'm not able to create the resource, instead getting</p>
  <pre><code>$ kubectl logs rbac-test
  Error from server (Forbidden): error when creating &quot;/config/aaa.yaml&quot;: configmaps is forbidden: User &quot;system:serviceaccount:default:rbac-test&quot; cannot create resource &quot;configmaps&quot; in API group &quot;&quot; in the namespace &quot;default&quot;
  </code></pre>
  <p>If I remove the <code>resourceNames</code> attribute I am able to create the configmap, but I don't necessarily want this pod to be able to create and update configmaps willy-nilly. How can I restrict the serviceAccount's roles so that this pod can manipulate only the named configmap <code>aaa</code>?</p>
  EDIT
  <p>I got some help in the kubernetes slack (thank you, Alan). RBAC happens at the level of the URL so resourceName-restricted authorization can't happen for create URLs since there is no resource name in the URL!</p>
  <pre class="lang-yaml prettyprint-override"><code>kind: Pod
  apiVersion: v1
  metadata:
    name: rbac-test
  spec:
    restartPolicy: Never
    serviceAccountName: rbac-test
    imagePullSecrets:
      - name: docker-hub-creds 
    containers:
      - name: rbac-test
        image: bitnami/kubectl
        command: [ &quot;kubectl&quot; ]
        args: [ &quot;apply&quot;, &quot;-f&quot;, &quot;/config/aaa.yaml&quot; ]
        volumeMounts:
          - name: aaa-config
            mountPath: /config/
    volumes:
      - name: aaa-config
        configMap:
          name: aaa-config
  
  ---
  kind: ConfigMap
  apiVersion: v1
  metadata:
    name: aaa-config
  data:
    aaa.yaml: |
      kind: ConfigMap
      apiVersion: v1
      metadata:
        name: aaa
      data:
        value: na
  
  ---
  apiVersion: v1     
  kind: ServiceAccount
  metadata:
    name: rbac-test
  
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: rbac-test
  rules:
    - apiGroups: [ &quot;&quot; ]
      resources: [ &quot;configmaps&quot; ]
      verbs: [ &quot;get&quot;, &quot;create&quot;, &quot;update&quot; ]
      resourceNames: [ &quot;aaa&quot; ]
  
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: rbac-test
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: rbac-test
  subjects:
    - kind: ServiceAccount
      name: rbac-test
  </code></pre>