Skip to content

Clarified RBAC doc about resourceNames field and create verb #50455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Clarified RBAC doc about resourceNames field and create verb #50455

wants to merge 5 commits into from

Conversation

NahisWayard
Copy link

Description

Clarified interaction between RBAC rules declaring resourceNames and verb create because the existing doc was misleading

Issue

Closes: #50454

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Apr 10, 2025
@k8s-ci-robot
Copy link
Contributor

Welcome @NahisWayard!

It looks like this is your first PR to kubernetes/website 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/website has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added language/en Issues or PRs related to English language size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Apr 10, 2025
@k8s-ci-robot k8s-ci-robot requested review from deads2k and liggitt April 10, 2025 09:51
@netlify Netlify
Copy link

netlify bot commented Apr 10, 2025 •
edited
Loading

✅ Pull request preview available for checking

Built without sensitive environment variables

Name Link
🔨 Latest commit ea3d6a1
🔍 Latest deploy log https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/68027a43290b1e00087e64ca
😎 Deploy Preview https://deploy-preview-50455--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

lmktfy
lmktfy reviewed Apr 14, 2025
View reviewed changes
Copy link
Contributor

@lmktfy lmktfy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We try to write API verbs in lowercase boldface.

I know the RBAC page doesn't do this yet, but my suggestion is aligned to the style we'd like to see.

In my opinion, it's OK to change just this one callout even whilst the overall page still needs fixes.

aramase
aramase reviewed Apr 21, 2025
View reviewed changes
content/en/docs/reference/access-authn-authz/rbac.md
If you restrict `list` or `watch` by resourceName, clients must include a `metadata.name` field selector in their `list` or `watch` request that matches the specified resourceName in order to be authorized.
For example, `kubectl get configmaps --field-selector=metadata.name=my-configmap`
You cannot restrict **deletecollection** or top-level **create** requests by resource name.
For **create**, this limitation is because the name of the new object may not be known at authorization time. However, the **create** limitation applies only to top-level resources, not subresources. For example, you can use the `resourceNames` field with `pods/exec`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We believe you can actually restrict this if you use Server side apply (SSA) for create. Could you try investigating that and updating the docs to cover that as well?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(it's also OK to file a new issue about SSA / resourceNames, and park this PR whilst that issue and detail gets addressed)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried to apply my tests resources declared in the issue i openned. I doesn't works either

@nate-double-u
Copy link
Contributor

Hi @NahisWayard, thanks for this, and welcome.

Since you haven’t responded to comments or feedback in 2 or more weeks, I’m closing this PR. Please feel free to reopen it when you can work on it again.

/close

@k8s-ci-robot
Copy link
Contributor

@nate-double-u: Closed this PR.

In response to this:

Hi @NahisWayard, thanks for this, and welcome.

Since you haven’t responded to comments or feedback in 2 or more weeks, I’m closing this PR. Please feel free to reopen it when you can work on it again.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@NahisWayard
Copy link
Author

/reopen

@k8s-ci-robot k8s-ci-robot reopened this May 7, 2025
@k8s-ci-robot
Copy link
Contributor

@NahisWayard: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rayandas for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@aramase aramase aramase left review comments

@lmktfy lmktfy lmktfy left review comments

@deads2k deads2k Awaiting requested review from deads2k

@liggitt liggitt Awaiting requested review from liggitt

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[RBAC DOC] Note about resourceNames giving misleading informations
5 participants
@NahisWayard @k8s-ci-robot @nate-double-u @aramase @lmktfy