From 162da6561bcf225fb97e537ca206ff4ad1a7e540 Mon Sep 17 00:00:00 2001 From: Abirdcfly Date: Thu, 19 Aug 2021 10:55:00 +0800 Subject: [PATCH 1/2] Update rbac.md: Describe in detail how to specify resourceNames when using list/watch verbs --- content/en/docs/reference/access-authn-authz/rbac.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index a954b5c513..5faf4a3ea8 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -279,8 +279,9 @@ rules: ``` {{< note >}} -You cannot restrict `create` or `deletecollection` requests by resourceName. For `create`, this -limitation is because the object name is not known at authorization time. +You cannot restrict `create` or `deletecollection` requests by their resource name. +For `create`, this limitation is because the name of the new object may not be known at authorization time. +If you restrict `list` or `watch` by resourceName, then the only way that a client including kubectl can perform that `list` or `watch` is by specifying a field selector that matches on metadata.name. {{< /note >}} From 19807f866c9bfa2f126022c1686999279e350ed3 Mon Sep 17 00:00:00 2001 From: Abirdcfly Date: Mon, 23 Aug 2021 21:45:10 +0800 Subject: [PATCH 2/2] Update content/en/docs/reference/access-authn-authz/rbac.md Co-authored-by: Jordan Liggitt --- content/en/docs/reference/access-authn-authz/rbac.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index 5faf4a3ea8..a75897d04a 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -281,7 +281,8 @@ rules: {{< note >}} You cannot restrict `create` or `deletecollection` requests by their resource name. For `create`, this limitation is because the name of the new object may not be known at authorization time. -If you restrict `list` or `watch` by resourceName, then the only way that a client including kubectl can perform that `list` or `watch` is by specifying a field selector that matches on metadata.name. +If you restrict `list` or `watch` by resourceName, clients must include a `metadata.name` field selector in their `list` or `watch` request that matches the specified resourceName in order to be authorized. +For example, `kubectl get configmaps --field-selector=metadata.name=my-configmap` {{< /note >}}