kubernetes reference kind SelfSubjectRulesReview import k8s io api authorization v1 SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace contenttype apireference apiVersion authorization k8s io v1 apimetadata weight 3 title SelfSubjectRulesReview autogenerated true

Answer:
---
api_metadata:
  apiVersion: "authorization.k8s.io/v1"
  import: "k8s.io/api/authorization/v1"
  kind: "SelfSubjectRulesReview"
content_type: "api_reference"
description: "SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace."
title: "SelfSubjectRulesReview"
weight: 3
auto_generated: true
---

`apiVersion: authorization.k8s.io/v1`

`import "k8s.io/api/authorization/v1"`

## SelfSubjectRulesReview {#SelfSubjectRulesReview}

SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace. The returned list of actions may be incomplete depending on the server's authorization mode, and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions, or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns. SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.

- **apiVersion**: authorization.k8s.io/v1

- **kind**: SelfSubjectRulesReview

- **metadata** (ObjectMeta)

  Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (SelfSubjectRulesReviewSpec), required

  Spec holds information about the request being evaluated.

- **status** (SubjectRulesReviewStatus)

  Status is filled in by the server and indicates the set of actions a user can perform.

  *SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation. Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, even if that list is incomplete.*

  - **status.incomplete** (boolean), required

    Incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.

  - **status.nonResourceRules** ([]NonResourceRule), required

    *Atomic: will be replaced during a merge*

    NonResourceRules is the list of actions the subject is allowed to perform on non-resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.

    *NonResourceRule holds information that describes a rule for the non-resource*

    - **status.nonResourceRules.verbs** ([]string), required

      *Atomic: will be replaced during a merge*

      Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options.  "*" means all.

    - **status.nonResourceRules.nonResourceURLs** ([]string)

      *Atomic: will be replaced during a merge*

      NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path.  "*" means all.

  - **status.resourceRules** ([]ResourceRule), required

    *Atomic: will be replaced during a merge*

    ResourceRules is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.

    *ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.*

    - **status.resourceRules.verbs** ([]string), required

      *Atomic: will be replaced during a merge*

      Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy.  "*" means all.

    - **status.resourceRules.apiGroups** ([]string)

      *Atomic: will be replaced during a merge*

      APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed.  "*" means all.

    - **status.resourceRules.resourceNames** ([]string)

      *Atomic: will be replaced during a merge*

      ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.  "*" means all.

    - **status.resourceRules.resources** ([]string)

      *Atomic: will be replaced during a merge*

      Resources is a list of resources this rule applies to.  "*" means all in the specified apiGroups.
       "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.

  - **status.evaluationError** (string)

    EvaluationError can appear in combination with Rules. It indicates an error occurred during rule evaluation, such as an authorizer that doesn't support rule evaluation, and that ResourceRules and/or NonResourceRules may be incomplete.

## SelfSubjectRulesReviewSpec {#SelfSubjectRulesReviewSpec}

SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.

- **namespace** (string)

  Namespace to evaluate rules for. Required.

## Operations {#Operations}

### `create` create a SelfSubjectRulesReview

#### HTTP Request

POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews

#### Parameters

- **body**: SelfSubjectRulesReview, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (SelfSubjectRulesReview): OK

201 (SelfSubjectRulesReview): Created

202 (SelfSubjectRulesReview): Accepted

401: Unauthorized

api metadata    apiVersion   authorization k8s io v1    import   k8s io api authorization v1    kind   SelfSubjectRulesReview  content type   api reference  description   SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace   title   SelfSubjectRulesReview  weight  3 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authorization k8s io v1    import  k8s io api authorization v1        SelfSubjectRulesReview   SelfSubjectRulesReview   SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace  The returned list of actions may be incomplete depending on the server s authorization mode  and any errors experienced during the evaluation  SelfSubjectRulesReview should be used by UIs to show hide actions  or to quickly let an end user reason about their permissions  It should NOT Be used by external systems to drive authorization decisions as this raises confused deputy  cache lifetime revocation  and correctness concerns  SubjectAccessReview  and LocalAccessReview are the correct way to defer authorization decisions to the API server    hr       apiVersion    authorization k8s io v1       kind    SelfSubjectRulesReview       metadata     a href    ObjectMeta  a      Standard list metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    SelfSubjectRulesReviewSpec  a    required    Spec holds information about the request being evaluated       status    SubjectRulesReviewStatus     Status is filled in by the server and indicates the set of actions a user can perform      a name  SubjectRulesReviewStatus    a     SubjectRulesReviewStatus contains the result of a rules check  This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation  Because authorization rules are additive  if a rule appears in a list it s safe to assume the subject has that permission  even if that list is incomplete          status incomplete    boolean   required      Incomplete is true when the rules returned by this call are incomplete  This is most commonly encountered when an authorizer  such as an external authorizer  doesn t support rules evaluation         status nonResourceRules      NonResourceRule   required       Atomic  will be replaced during a merge           NonResourceRules is the list of actions the subject is allowed to perform on non resources  The list ordering isn t significant  may contain duplicates  and possibly be incomplete        a name  NonResourceRule    a       NonResourceRule holds information that describes a rule for the non resource           status nonResourceRules verbs      string   required         Atomic  will be replaced during a merge               Verb is a list of kubernetes non resource API verbs  like  get  post  put  delete  patch  head  options       means all           status nonResourceRules nonResourceURLs      string          Atomic  will be replaced during a merge               NonResourceURLs is a set of partial urls that a user should have access to    s are allowed  but only as the full  final step in the path       means all         status resourceRules      ResourceRule   required       Atomic  will be replaced during a merge           ResourceRules is the list of actions the subject is allowed to perform on resources  The list ordering isn t significant  may contain duplicates  and possibly be incomplete        a name  ResourceRule    a       ResourceRule is the list of actions the subject is allowed to perform on resources  The list ordering isn t significant  may contain duplicates  and possibly be incomplete            status resourceRules verbs      string   required         Atomic  will be replaced during a merge               Verb is a list of kubernetes resource API verbs  like  get  list  watch  create  update  delete  proxy       means all           status resourceRules apiGroups      string          Atomic  will be replaced during a merge               APIGroups is the name of the APIGroup that contains the resources   If multiple API groups are specified  any action requested against one of the enumerated resources in any API group will be allowed       means all           status resourceRules resourceNames      string          Atomic  will be replaced during a merge               ResourceNames is an optional white list of names that the rule applies to   An empty set means that everything is allowed       means all           status resourceRules resources      string          Atomic  will be replaced during a merge               Resources is a list of resources this rule applies to       means all in the specified apiGroups            foo  represents the subresource  foo  for all resources in the specified apiGroups         status evaluationError    string       EvaluationError can appear in combination with Rules  It indicates an error occurred during rule evaluation  such as an authorizer that doesn t support rule evaluation  and that ResourceRules and or NonResourceRules may be incomplete          SelfSubjectRulesReviewSpec   SelfSubjectRulesReviewSpec   SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview    hr       namespace    string     Namespace to evaluate rules for  Required          Operations   Operations      hr             create  create a SelfSubjectRulesReview       HTTP Request  POST  apis authorization k8s io v1 selfsubjectrulesreviews       Parameters       body     a href    SelfSubjectRulesReview  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    SelfSubjectRulesReview  a    OK  201   a href    SelfSubjectRulesReview  a    Created  202   a href    SelfSubjectRulesReview  a    Accepted  401  Unauthorized


kubernetes reference kind LocalSubjectAccessReview LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace title LocalSubjectAccessReview import k8s io api authorization v1 contenttype apireference apiVersion authorization k8s io v1 apimetadata autogenerated true weight 1

Answer:
---
api_metadata:
  apiVersion: "authorization.k8s.io/v1"
  import: "k8s.io/api/authorization/v1"
  kind: "LocalSubjectAccessReview"
content_type: "api_reference"
description: "LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace."
title: "LocalSubjectAccessReview"
weight: 1
auto_generated: true
---

`apiVersion: authorization.k8s.io/v1`

`import "k8s.io/api/authorization/v1"`

## LocalSubjectAccessReview {#LocalSubjectAccessReview}

LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking.

- **apiVersion**: authorization.k8s.io/v1

- **kind**: LocalSubjectAccessReview

- **metadata** (ObjectMeta)

  Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (SubjectAccessReviewSpec), required

  Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace you made the request against.  If empty, it is defaulted.

- **status** (SubjectAccessReviewStatus)

  Status is filled in by the server and indicates whether the request is allowed or not

## Operations {#Operations}

### `create` create a LocalSubjectAccessReview

#### HTTP Request

POST /apis/authorization.k8s.io/v1/namespaces/{namespace}/localsubjectaccessreviews

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: LocalSubjectAccessReview, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (LocalSubjectAccessReview): OK

201 (LocalSubjectAccessReview): Created

202 (LocalSubjectAccessReview): Accepted

401: Unauthorized

api metadata    apiVersion   authorization k8s io v1    import   k8s io api authorization v1    kind   LocalSubjectAccessReview  content type   api reference  description   LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace   title   LocalSubjectAccessReview  weight  1 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authorization k8s io v1    import  k8s io api authorization v1        LocalSubjectAccessReview   LocalSubjectAccessReview   LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace  Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking    hr       apiVersion    authorization k8s io v1       kind    LocalSubjectAccessReview       metadata     a href    ObjectMeta  a      Standard list metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    SubjectAccessReviewSpec  a    required    Spec holds information about the request being evaluated   spec namespace must be equal to the namespace you made the request against   If empty  it is defaulted       status     a href    SubjectAccessReviewStatus  a      Status is filled in by the server and indicates whether the request is allowed or not         Operations   Operations      hr             create  create a LocalSubjectAccessReview       HTTP Request  POST  apis authorization k8s io v1 namespaces  namespace  localsubjectaccessreviews       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    LocalSubjectAccessReview  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    LocalSubjectAccessReview  a    OK  201   a href    LocalSubjectAccessReview  a    Created  202   a href    LocalSubjectAccessReview  a    Accepted  401  Unauthorized


kubernetes reference import k8s io api rbac v1 apiVersion rbac authorization k8s io v1 contenttype apireference title RoleBinding weight 8 apimetadata autogenerated true kind RoleBinding RoleBinding references a role but does not contain it

Answer:
---
api_metadata:
  apiVersion: "rbac.authorization.k8s.io/v1"
  import: "k8s.io/api/rbac/v1"
  kind: "RoleBinding"
content_type: "api_reference"
description: "RoleBinding references a role, but does not contain it."
title: "RoleBinding"
weight: 8
auto_generated: true
---

`apiVersion: rbac.authorization.k8s.io/v1`

`import "k8s.io/api/rbac/v1"`

## RoleBinding {#RoleBinding}

RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given namespace only have effect in that namespace.

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: RoleBinding

- **metadata** (ObjectMeta)

  Standard object's metadata.

- **roleRef** (RoleRef), required

  RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.

  *RoleRef contains information that points to the role being used*

  - **roleRef.apiGroup** (string), required

    APIGroup is the group for the resource being referenced

  - **roleRef.kind** (string), required

    Kind is the type of resource being referenced

  - **roleRef.name** (string), required

    Name is the name of resource being referenced

- **subjects** ([]Subject)

  *Atomic: will be replaced during a merge*

  Subjects holds references to the objects the role applies to.

  *Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.*

  - **subjects.kind** (string), required

    Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.

  - **subjects.name** (string), required

    Name of the object being referenced.

  - **subjects.apiGroup** (string)

    APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.

  - **subjects.namespace** (string)

    Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

## RoleBindingList {#RoleBindingList}

RoleBindingList is a collection of RoleBindings

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: RoleBindingList

- **metadata** (ListMeta)

  Standard object's metadata.

- **items** ([]RoleBinding), required

  Items is a list of RoleBindings

## Operations {#Operations}

### `get` read the specified RoleBinding

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the RoleBinding

- **namespace** (*in path*): string, required

  namespace

- **pretty** (*in query*): string

  pretty

#### Response

200 (RoleBinding): OK

401: Unauthorized

### `list` list or watch objects of kind RoleBinding

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (RoleBindingList): OK

401: Unauthorized

### `list` list or watch objects of kind RoleBinding

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/rolebindings

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (RoleBindingList): OK

401: Unauthorized

### `create` create a RoleBinding

#### HTTP Request

POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: RoleBinding, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (RoleBinding): OK

201 (RoleBinding): Created

202 (RoleBinding): Accepted

401: Unauthorized

### `update` replace the specified RoleBinding

#### HTTP Request

PUT /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the RoleBinding

- **namespace** (*in path*): string, required

  namespace

- **body**: RoleBinding, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (RoleBinding): OK

201 (RoleBinding): Created

401: Unauthorized

### `patch` partially update the specified RoleBinding

#### HTTP Request

PATCH /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the RoleBinding

- **namespace** (*in path*): string, required

  namespace

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (RoleBinding): OK

201 (RoleBinding): Created

401: Unauthorized

### `delete` delete a RoleBinding

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the RoleBinding

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of RoleBinding

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   rbac authorization k8s io v1    import   k8s io api rbac v1    kind   RoleBinding  content type   api reference  description   RoleBinding references a role  but does not contain it   title   RoleBinding  weight  8 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  rbac authorization k8s io v1    import  k8s io api rbac v1        RoleBinding   RoleBinding   RoleBinding references a role  but does not contain it   It can reference a Role in the same namespace or a ClusterRole in the global namespace  It adds who information via Subjects and namespace information by which namespace it exists in   RoleBindings in a given namespace only have effect in that namespace    hr       apiVersion    rbac authorization k8s io v1       kind    RoleBinding       metadata     a href    ObjectMeta  a      Standard object s metadata       roleRef    RoleRef   required    RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace  If the RoleRef cannot be resolved  the Authorizer must return an error  This field is immutable      a name  RoleRef    a     RoleRef contains information that points to the role being used         roleRef apiGroup    string   required      APIGroup is the group for the resource being referenced        roleRef kind    string   required      Kind is the type of resource being referenced        roleRef name    string   required      Name is the name of resource being referenced      subjects      Subject      Atomic  will be replaced during a merge       Subjects holds references to the objects the role applies to      a name  Subject    a     Subject contains a reference to the object or user identities a role binding applies to   This can either hold a direct API object reference  or a value for non objects such as user and group names          subjects kind    string   required      Kind of object being referenced  Values defined by this API group are  User    Group   and  ServiceAccount   If the Authorizer does not recognized the kind value  the Authorizer should report an error         subjects name    string   required      Name of the object being referenced         subjects apiGroup    string       APIGroup holds the API group of the referenced subject  Defaults to    for ServiceAccount subjects  Defaults to  rbac authorization k8s io  for User and Group subjects         subjects namespace    string       Namespace of the referenced object   If the object kind is non namespace  such as  User  or  Group   and this value is not empty the Authorizer should report an error          RoleBindingList   RoleBindingList   RoleBindingList is a collection of RoleBindings   hr       apiVersion    rbac authorization k8s io v1       kind    RoleBindingList       metadata     a href    ListMeta  a      Standard object s metadata       items       a href    RoleBinding  a    required    Items is a list of RoleBindings         Operations   Operations      hr             get  read the specified RoleBinding       HTTP Request  GET  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings  name        Parameters       name     in path    string  required    name of the RoleBinding       namespace     in path    string  required     a href    namespace  a        pretty     in query    string     a href    pretty  a          Response   200   a href    RoleBinding  a    OK  401  Unauthorized        list  list or watch objects of kind RoleBinding       HTTP Request  GET  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings       Parameters       namespace     in path    string  required     a href    namespace  a        allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    RoleBindingList  a    OK  401  Unauthorized        list  list or watch objects of kind RoleBinding       HTTP Request  GET  apis rbac authorization k8s io v1 rolebindings       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    RoleBindingList  a    OK  401  Unauthorized        create  create a RoleBinding       HTTP Request  POST  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    RoleBinding  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    RoleBinding  a    OK  201   a href    RoleBinding  a    Created  202   a href    RoleBinding  a    Accepted  401  Unauthorized        update  replace the specified RoleBinding       HTTP Request  PUT  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings  name        Parameters       name     in path    string  required    name of the RoleBinding       namespace     in path    string  required     a href    namespace  a        body     a href    RoleBinding  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    RoleBinding  a    OK  201   a href    RoleBinding  a    Created  401  Unauthorized        patch  partially update the specified RoleBinding       HTTP Request  PATCH  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings  name        Parameters       name     in path    string  required    name of the RoleBinding       namespace     in path    string  required     a href    namespace  a        body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    RoleBinding  a    OK  201   a href    RoleBinding  a    Created  401  Unauthorized        delete  delete a RoleBinding       HTTP Request  DELETE  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings  name        Parameters       name     in path    string  required    name of the RoleBinding       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of RoleBinding       HTTP Request  DELETE  apis rbac authorization k8s io v1 namespaces  namespace  rolebindings       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference weight 7 title Role import k8s io api rbac v1 apiVersion rbac authorization k8s io v1 contenttype apireference Role is a namespaced logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding apimetadata autogenerated true kind Role

Answer:
---
api_metadata:
  apiVersion: "rbac.authorization.k8s.io/v1"
  import: "k8s.io/api/rbac/v1"
  kind: "Role"
content_type: "api_reference"
description: "Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding."
title: "Role"
weight: 7
auto_generated: true
---

`apiVersion: rbac.authorization.k8s.io/v1`

`import "k8s.io/api/rbac/v1"`

## Role {#Role}

Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: Role

- **metadata** (ObjectMeta)

  Standard object's metadata.

- **rules** ([]PolicyRule)

  *Atomic: will be replaced during a merge*

  Rules holds all the PolicyRules for this Role

  *PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.*

  - **rules.apiGroups** ([]string)

    *Atomic: will be replaced during a merge*

    APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.

  - **rules.resources** ([]string)

    *Atomic: will be replaced during a merge*

    Resources is a list of resources this rule applies to. '*' represents all resources.

  - **rules.verbs** ([]string), required

    *Atomic: will be replaced during a merge*

    Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.

  - **rules.resourceNames** ([]string)

    *Atomic: will be replaced during a merge*

    ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.

  - **rules.nonResourceURLs** ([]string)

    *Atomic: will be replaced during a merge*

    NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.

## RoleList {#RoleList}

RoleList is a collection of Roles

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: RoleList

- **metadata** (ListMeta)

  Standard object's metadata.

- **items** ([]Role), required

  Items is a list of Roles

## Operations {#Operations}

### `get` read the specified Role

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the Role

- **namespace** (*in path*): string, required

  namespace

- **pretty** (*in query*): string

  pretty

#### Response

200 (Role): OK

401: Unauthorized

### `list` list or watch objects of kind Role

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (RoleList): OK

401: Unauthorized

### `list` list or watch objects of kind Role

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/roles

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (RoleList): OK

401: Unauthorized

### `create` create a Role

#### HTTP Request

POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: Role, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (Role): OK

201 (Role): Created

202 (Role): Accepted

401: Unauthorized

### `update` replace the specified Role

#### HTTP Request

PUT /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the Role

- **namespace** (*in path*): string, required

  namespace

- **body**: Role, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (Role): OK

201 (Role): Created

401: Unauthorized

### `patch` partially update the specified Role

#### HTTP Request

PATCH /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the Role

- **namespace** (*in path*): string, required

  namespace

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (Role): OK

201 (Role): Created

401: Unauthorized

### `delete` delete a Role

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the Role

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of Role

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   rbac authorization k8s io v1    import   k8s io api rbac v1    kind   Role  content type   api reference  description   Role is a namespaced  logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding   title   Role  weight  7 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  rbac authorization k8s io v1    import  k8s io api rbac v1        Role   Role   Role is a namespaced  logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding    hr       apiVersion    rbac authorization k8s io v1       kind    Role       metadata     a href    ObjectMeta  a      Standard object s metadata       rules      PolicyRule      Atomic  will be replaced during a merge       Rules holds all the PolicyRules for this Role     a name  PolicyRule    a     PolicyRule holds information that describes a policy rule  but does not contain information about who the rule applies to or which namespace the rule applies to          rules apiGroups      string        Atomic  will be replaced during a merge           APIGroups is the name of the APIGroup that contains the resources   If multiple API groups are specified  any action requested against one of the enumerated resources in any API group will be allowed     represents the core API group and     represents all API groups         rules resources      string        Atomic  will be replaced during a merge           Resources is a list of resources this rule applies to      represents all resources         rules verbs      string   required       Atomic  will be replaced during a merge           Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule      represents all verbs         rules resourceNames      string        Atomic  will be replaced during a merge           ResourceNames is an optional white list of names that the rule applies to   An empty set means that everything is allowed         rules nonResourceURLs      string        Atomic  will be replaced during a merge           NonResourceURLs is a set of partial urls that a user should have access to    s are allowed  but only as the full  final step in the path Since non resource URLs are not namespaced  this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding  Rules can either apply to API resources  such as  pods  or  secrets   or non resource URL paths  such as   api     but not both          RoleList   RoleList   RoleList is a collection of Roles   hr       apiVersion    rbac authorization k8s io v1       kind    RoleList       metadata     a href    ListMeta  a      Standard object s metadata       items       a href    Role  a    required    Items is a list of Roles         Operations   Operations      hr             get  read the specified Role       HTTP Request  GET  apis rbac authorization k8s io v1 namespaces  namespace  roles  name        Parameters       name     in path    string  required    name of the Role       namespace     in path    string  required     a href    namespace  a        pretty     in query    string     a href    pretty  a          Response   200   a href    Role  a    OK  401  Unauthorized        list  list or watch objects of kind Role       HTTP Request  GET  apis rbac authorization k8s io v1 namespaces  namespace  roles       Parameters       namespace     in path    string  required     a href    namespace  a        allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    RoleList  a    OK  401  Unauthorized        list  list or watch objects of kind Role       HTTP Request  GET  apis rbac authorization k8s io v1 roles       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    RoleList  a    OK  401  Unauthorized        create  create a Role       HTTP Request  POST  apis rbac authorization k8s io v1 namespaces  namespace  roles       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    Role  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    Role  a    OK  201   a href    Role  a    Created  202   a href    Role  a    Accepted  401  Unauthorized        update  replace the specified Role       HTTP Request  PUT  apis rbac authorization k8s io v1 namespaces  namespace  roles  name        Parameters       name     in path    string  required    name of the Role       namespace     in path    string  required     a href    namespace  a        body     a href    Role  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    Role  a    OK  201   a href    Role  a    Created  401  Unauthorized        patch  partially update the specified Role       HTTP Request  PATCH  apis rbac authorization k8s io v1 namespaces  namespace  roles  name        Parameters       name     in path    string  required    name of the Role       namespace     in path    string  required     a href    namespace  a        body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    Role  a    OK  201   a href    Role  a    Created  401  Unauthorized        delete  delete a Role       HTTP Request  DELETE  apis rbac authorization k8s io v1 namespaces  namespace  roles  name        Parameters       name     in path    string  required    name of the Role       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of Role       HTTP Request  DELETE  apis rbac authorization k8s io v1 namespaces  namespace  roles       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference kind ClusterRole weight 5 title ClusterRole import k8s io api rbac v1 apiVersion rbac authorization k8s io v1 contenttype apireference apimetadata autogenerated true ClusterRole is a cluster level logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding

Answer:
---
api_metadata:
  apiVersion: "rbac.authorization.k8s.io/v1"
  import: "k8s.io/api/rbac/v1"
  kind: "ClusterRole"
content_type: "api_reference"
description: "ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding."
title: "ClusterRole"
weight: 5
auto_generated: true
---

`apiVersion: rbac.authorization.k8s.io/v1`

`import "k8s.io/api/rbac/v1"`

## ClusterRole {#ClusterRole}

ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: ClusterRole

- **metadata** (ObjectMeta)

  Standard object's metadata.

- **aggregationRule** (AggregationRule)

  AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.

  *AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole*

  - **aggregationRule.clusterRoleSelectors** ([]LabelSelector)

    *Atomic: will be replaced during a merge*

    ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added

- **rules** ([]PolicyRule)

  *Atomic: will be replaced during a merge*

  Rules holds all the PolicyRules for this ClusterRole

  *PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.*

  - **rules.apiGroups** ([]string)

    *Atomic: will be replaced during a merge*

    APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.

  - **rules.resources** ([]string)

    *Atomic: will be replaced during a merge*

    Resources is a list of resources this rule applies to. '*' represents all resources.

  - **rules.verbs** ([]string), required

    *Atomic: will be replaced during a merge*

    Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.

  - **rules.resourceNames** ([]string)

    *Atomic: will be replaced during a merge*

    ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.

  - **rules.nonResourceURLs** ([]string)

    *Atomic: will be replaced during a merge*

    NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.

## ClusterRoleList {#ClusterRoleList}

ClusterRoleList is a collection of ClusterRoles

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: ClusterRoleList

- **metadata** (ListMeta)

  Standard object's metadata.

- **items** ([]ClusterRole), required

  Items is a list of ClusterRoles

## Operations {#Operations}

### `get` read the specified ClusterRole

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/clusterroles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRole

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRole): OK

401: Unauthorized

### `list` list or watch objects of kind ClusterRole

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/clusterroles

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (ClusterRoleList): OK

401: Unauthorized

### `create` create a ClusterRole

#### HTTP Request

POST /apis/rbac.authorization.k8s.io/v1/clusterroles

#### Parameters

- **body**: ClusterRole, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRole): OK

201 (ClusterRole): Created

202 (ClusterRole): Accepted

401: Unauthorized

### `update` replace the specified ClusterRole

#### HTTP Request

PUT /apis/rbac.authorization.k8s.io/v1/clusterroles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRole

- **body**: ClusterRole, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRole): OK

201 (ClusterRole): Created

401: Unauthorized

### `patch` partially update the specified ClusterRole

#### HTTP Request

PATCH /apis/rbac.authorization.k8s.io/v1/clusterroles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRole

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRole): OK

201 (ClusterRole): Created

401: Unauthorized

### `delete` delete a ClusterRole

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/clusterroles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRole

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of ClusterRole

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/clusterroles

#### Parameters

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   rbac authorization k8s io v1    import   k8s io api rbac v1    kind   ClusterRole  content type   api reference  description   ClusterRole is a cluster level  logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding   title   ClusterRole  weight  5 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  rbac authorization k8s io v1    import  k8s io api rbac v1        ClusterRole   ClusterRole   ClusterRole is a cluster level  logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding    hr       apiVersion    rbac authorization k8s io v1       kind    ClusterRole       metadata     a href    ObjectMeta  a      Standard object s metadata       aggregationRule    AggregationRule     AggregationRule is an optional field that describes how to build the Rules for this ClusterRole  If AggregationRule is set  then the Rules are controller managed and direct changes to Rules will be stomped by the controller      a name  AggregationRule    a     AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole         aggregationRule clusterRoleSelectors       a href    LabelSelector  a         Atomic  will be replaced during a merge           ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules  If any of the selectors match  then the ClusterRole s permissions will be added      rules      PolicyRule      Atomic  will be replaced during a merge       Rules holds all the PolicyRules for this ClusterRole     a name  PolicyRule    a     PolicyRule holds information that describes a policy rule  but does not contain information about who the rule applies to or which namespace the rule applies to          rules apiGroups      string        Atomic  will be replaced during a merge           APIGroups is the name of the APIGroup that contains the resources   If multiple API groups are specified  any action requested against one of the enumerated resources in any API group will be allowed     represents the core API group and     represents all API groups         rules resources      string        Atomic  will be replaced during a merge           Resources is a list of resources this rule applies to      represents all resources         rules verbs      string   required       Atomic  will be replaced during a merge           Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule      represents all verbs         rules resourceNames      string        Atomic  will be replaced during a merge           ResourceNames is an optional white list of names that the rule applies to   An empty set means that everything is allowed         rules nonResourceURLs      string        Atomic  will be replaced during a merge           NonResourceURLs is a set of partial urls that a user should have access to    s are allowed  but only as the full  final step in the path Since non resource URLs are not namespaced  this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding  Rules can either apply to API resources  such as  pods  or  secrets   or non resource URL paths  such as   api     but not both          ClusterRoleList   ClusterRoleList   ClusterRoleList is a collection of ClusterRoles   hr       apiVersion    rbac authorization k8s io v1       kind    ClusterRoleList       metadata     a href    ListMeta  a      Standard object s metadata       items       a href    ClusterRole  a    required    Items is a list of ClusterRoles         Operations   Operations      hr             get  read the specified ClusterRole       HTTP Request  GET  apis rbac authorization k8s io v1 clusterroles  name        Parameters       name     in path    string  required    name of the ClusterRole       pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRole  a    OK  401  Unauthorized        list  list or watch objects of kind ClusterRole       HTTP Request  GET  apis rbac authorization k8s io v1 clusterroles       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    ClusterRoleList  a    OK  401  Unauthorized        create  create a ClusterRole       HTTP Request  POST  apis rbac authorization k8s io v1 clusterroles       Parameters       body     a href    ClusterRole  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRole  a    OK  201   a href    ClusterRole  a    Created  202   a href    ClusterRole  a    Accepted  401  Unauthorized        update  replace the specified ClusterRole       HTTP Request  PUT  apis rbac authorization k8s io v1 clusterroles  name        Parameters       name     in path    string  required    name of the ClusterRole       body     a href    ClusterRole  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRole  a    OK  201   a href    ClusterRole  a    Created  401  Unauthorized        patch  partially update the specified ClusterRole       HTTP Request  PATCH  apis rbac authorization k8s io v1 clusterroles  name        Parameters       name     in path    string  required    name of the ClusterRole       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRole  a    OK  201   a href    ClusterRole  a    Created  401  Unauthorized        delete  delete a ClusterRole       HTTP Request  DELETE  apis rbac authorization k8s io v1 clusterroles  name        Parameters       name     in path    string  required    name of the ClusterRole       body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of ClusterRole       HTTP Request  DELETE  apis rbac authorization k8s io v1 clusterroles       Parameters       body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized