<p dir="auto">Problem: the following codes just hang and never returns</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content=" clientset, err := kubernetes.NewForConfig(config)
 pods, err := clientset.Core().Pods(&quot;&quot;).List(api.ListOptions{Watch:true})"><pre class="notranslate"><code class="notranslate"> clientset, err := kubernetes.NewForConfig(config)
 pods, err := clientset.Core().Pods("").List(api.ListOptions{Watch:true})
</code></pre></div>
<p dir="auto">while codes like:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="watch, err := clientset.Core().Pods(&quot;&quot;).Watch(api.ListOptions{})"><pre class="notranslate"><code class="notranslate">watch, err := clientset.Core().Pods("").Watch(api.ListOptions{})
</code></pre></div>
<p dir="auto">work as expected.<br>
IMHO,  the first use is kind of misleading.</p>

<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.):</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.):</p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one):</p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>:</li>
<li><strong>OS</strong> (e.g. from /etc/os-release):</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):</li>
<li><strong>Install tools</strong>:</li>
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>:</p>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<p dir="auto"><strong>Anything else do we need to know</strong>:</p>
<p dir="auto">Talking with <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ericchiang/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ericchiang">@ericchiang</a> a bit, my understanding of the RBAC PolicyRule's <code class="notranslate">apiGroups</code> field is that it determines which API groups the authorizer looks for resources in. For example, if you want to authorize the resource "deployments," you need to explicitly include the "extensions" API group:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="kind: &quot;Role&quot;
apiVersion: &quot;rbac.authorization.k8s.io/v1alpha1&quot;
metadata:
  name: &quot;deployer&quot;
rules:
  - apiGroups: [&quot;extensions&quot;]
    resources: [&quot;deployments&quot;]
    verbs: [&quot;*&quot;]"><pre class="notranslate"><span class="pl-ent">kind</span>: <span class="pl-s"><span class="pl-pds">"</span>Role<span class="pl-pds">"</span></span>
<span class="pl-ent">apiVersion</span>: <span class="pl-s"><span class="pl-pds">"</span>rbac.authorization.k8s.io/v1alpha1<span class="pl-pds">"</span></span>
<span class="pl-ent">metadata</span>:
  <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>deployer<span class="pl-pds">"</span></span>
<span class="pl-ent">rules</span>:
  - <span class="pl-ent">apiGroups</span>: <span class="pl-s">["extensions"]</span>
    <span class="pl-ent">resources</span>: <span class="pl-s">["deployments"]</span>
    <span class="pl-ent">verbs</span>: <span class="pl-s">["*"]</span></pre></div>
<p dir="auto">The reason for this is to help disambiguate resources if resources of the same name exist in more than one API group. However, because both the <code class="notranslate">apiGroups</code> and <code class="notranslate">resources</code> fields are arrays, it actually creates a matrix of request allowances which is likely not what the user intended. For example, say I want to authorize requests for "resource1" in the API group "group1" and "resource2" in the API group "group2." I'd write this:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="kind: &quot;Role&quot;
apiVersion: &quot;rbac.authorization.k8s.io/v1alpha1&quot;
metadata:
  name: &quot;problem&quot;
rules:
  - apiGroups: [&quot;group1&quot;, &quot;group2&quot;]
    resources: [&quot;resource1&quot;, &quot;resource2&quot;]
    verbs: [&quot;*&quot;]"><pre class="notranslate"><span class="pl-ent">kind</span>: <span class="pl-s"><span class="pl-pds">"</span>Role<span class="pl-pds">"</span></span>
<span class="pl-ent">apiVersion</span>: <span class="pl-s"><span class="pl-pds">"</span>rbac.authorization.k8s.io/v1alpha1<span class="pl-pds">"</span></span>
<span class="pl-ent">metadata</span>:
  <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>problem<span class="pl-pds">"</span></span>
<span class="pl-ent">rules</span>:
  - <span class="pl-ent">apiGroups</span>: <span class="pl-s">["group1", "group2"]</span>
    <span class="pl-ent">resources</span>: <span class="pl-s">["resource1", "resource2"]</span>
    <span class="pl-ent">verbs</span>: <span class="pl-s">["*"]</span></pre></div>
<p dir="auto">If it turns out that resources with those two names both happen to exist in both API groups, then I've actually authorized four different resources instead of the intended two. In order to properly express what I want, I'd have to create two rules, each with one group and one resource.</p>
<p dir="auto">Because of this behavior, it doesn't make sense to me that the <code class="notranslate">apiGroups</code> field should allow more than one value. Either it should be limited to a single API group name, to prevent any accidental overlap of resource names between API groups, or it should be removed entirely, and resources should be qualified with their API group as a prefix. Below are examples of them written in those two different ways:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="kind: &quot;Role&quot;
apiVersion: &quot;rbac.authorization.k8s.io/v1alpha1&quot;
metadata:
  name: &quot;problem&quot;
rules:
  - apiGroups: &quot;group1&quot;
    resources: [&quot;resource1&quot;]
    verbs: [&quot;*&quot;]
  - apiGroups: &quot;group2&quot;
    resources: [&quot;resource2&quot;]
    verbs: [&quot;*&quot;]"><pre class="notranslate"><span class="pl-ent">kind</span>: <span class="pl-s"><span class="pl-pds">"</span>Role<span class="pl-pds">"</span></span>
<span class="pl-ent">apiVersion</span>: <span class="pl-s"><span class="pl-pds">"</span>rbac.authorization.k8s.io/v1alpha1<span class="pl-pds">"</span></span>
<span class="pl-ent">metadata</span>:
  <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>problem<span class="pl-pds">"</span></span>
<span class="pl-ent">rules</span>:
  - <span class="pl-ent">apiGroups</span>: <span class="pl-s"><span class="pl-pds">"</span>group1<span class="pl-pds">"</span></span>
    <span class="pl-ent">resources</span>: <span class="pl-s">["resource1"]</span>
    <span class="pl-ent">verbs</span>: <span class="pl-s">["*"]</span>
  - <span class="pl-ent">apiGroups</span>: <span class="pl-s"><span class="pl-pds">"</span>group2<span class="pl-pds">"</span></span>
    <span class="pl-ent">resources</span>: <span class="pl-s">["resource2"]</span>
    <span class="pl-ent">verbs</span>: <span class="pl-s">["*"]</span></pre></div>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="kind: &quot;Role&quot;
apiVersion: &quot;rbac.authorization.k8s.io/v1alpha1&quot;
metadata:
  name: &quot;problem&quot;
rules:
  - resources: [&quot;group1/resource1&quot;, &quot;group2/resource2&quot;]
    verbs: [&quot;*&quot;]"><pre class="notranslate"><span class="pl-ent">kind</span>: <span class="pl-s"><span class="pl-pds">"</span>Role<span class="pl-pds">"</span></span>
<span class="pl-ent">apiVersion</span>: <span class="pl-s"><span class="pl-pds">"</span>rbac.authorization.k8s.io/v1alpha1<span class="pl-pds">"</span></span>
<span class="pl-ent">metadata</span>:
  <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>problem<span class="pl-pds">"</span></span>
<span class="pl-ent">rules</span>:
  - <span class="pl-ent">resources</span>: <span class="pl-s">["group1/resource1", "group2/resource2"]</span>
    <span class="pl-ent">verbs</span>: <span class="pl-s">["*"]</span></pre></div>
<p dir="auto">The first example is basically what you have to do today to get exactly the desired semantics, with the added benefit of <code class="notranslate">apiGroups</code>'s type enforcing that you do it this way. The second example is less verbose because you can do what you want in a single rule. The downside to the second example is that lists of resources become more verbose in general.</p>
<p dir="auto">Refs <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="152862480" data-permission-text="Title is private" data-url="https://github.com/kubernetes/enhancements/issues/2" data-hovercard-type="issue" data-hovercard-url="/kubernetes/enhancements/issues/2/hovercard" href="https://github.com/kubernetes/enhancements/issues/2">kubernetes/enhancements#2</a>.</p>