APIs like DaemonSet.get(name, namespace) should not require RBAC list permission

[OvervCW]

Which project are you reporting a bug for?

kr8s

What happened?

Functions like DaemonSet.get fail when accessing the API through a service account that is permitted to use the get verb but not the list verb.

Coming from the kubernetes/kubernetes-asyncio libraries I would not expect that this function call requires the list verb because it shouldn't be doing any listing.

Having to add this verb to the associated role affects security.

Anything else?

No response

[jacobtomlinson]

Agreed. We should dig into where the list is being triggered. We might be accidentally triggering this before actually getting the resource.

We should also explore other operations like .patch(), .delete(), etc and ensure they work with minimal permissions.

In the tests we have a minimal service account which is only allowed get, list and watch on Pods. We could make this fixture more generic to allow for more flexible testing of other permission sets.

kr8s/kr8s/tests/resources/serviceaccount.yaml

Line 29 in 55168d3

verbs: ["get", "watch", "list"]