An API group is a named collection of related Kubernetes API resources and versions. RBAC rules use API groups to identify which resources and actions a user may access. section 12.6
In RBAC rules, API groups determine where permissions apply:
- The empty string "" identifies the core API grouping, which includes resources such as Pods, Services, Secrets, ConfigMaps, namespaces, and persistent volume claims. section 12.6
- Named groups such as apps, autoscaling, batch, networking.k8s.io, and policy contain other deployable resource types. section 12.6
- A Role grants access within a namespace, while a ClusterRole can grant access to cluster-scoped resources in groups such as scheduling.k8s.io and storage.k8s.io. section 12.6
A permission failure identifies the group
When a user attempts to create a Deployment without permission, Kubernetes reports that deployments.apps is forbidden. The resource is deployments, and apps is its API group.
