Fix: Ensure resource names in ClusterRole are plural and lowercase #50370
Conversation
… lowercase Resource names in RBAC must be specified in their plural and lowercase form. Previously, using a singular resource name caused issues with ClusterRole bindings. This update clarifies the requirement in rbac.md to prevent similar errors in the future.
The committers listed above are authorized under a signed CLA. |
k8s-ci-robot
added
the
cncf-cla: no
|
Welcome @Ajayss04! |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
size/XS
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
/sig auth |
k8s-ci-robot
added
the
sig/auth
There was a problem hiding this comment.
This isn't really specific to RBAC, so it might also be worth clarifying on this page https://kubernetes.io/docs/reference/access-authn-authz/authorization/#request-attributes-used-in-authorization
But I don't object to repeating the details here.
| Note: When specifying resources in a ClusterRole or Role, always use the plural and lowercase form of the resource name. | ||
| For example, use pods instead of pod, services instead of service. | ||
| Incorrect resource names will cause RBAC policies to fail. |
There was a problem hiding this comment.
The important part is that it match the REST API URL, which for built-in types is always plural and lowercase, but might not be for aggregated API servers.
| Note: When specifying resources in a ClusterRole or Role, always use the plural and lowercase form of the resource name. | |
| For example, use pods instead of pod, services instead of service. | |
| Incorrect resource names will cause RBAC policies to fail. | |
| Note: When specifying resources in a ClusterRole or Role, always use the resource exactly as it appears in the REST API path segment. | |
| For example, use `pods` instead of `pod` or `Pods`. | |
| Resources that do not exactly match the REST API path segment will not authorize the request. |
Description
Resource names in RBAC must be specified in their plural and lowercase form.
Previously, using a singular resource name caused issues with ClusterRole bindings.
This update clarifies the requirement in rbac.md to prevent similar errors in the future.
Issue
#50352
Closes: #50352