title: What role permissions are required to support “rollout undo”?
body: <p>I’m trying to set up a role for our CI/CD server that can support rolling back a failed deployment.  The current permissions are working for updating a deployment and related resources and monitoring their status, but when I attempt to run for example “kubectl rollout undo deployment/admin” as the CI user I get the error:</p>
  <blockquote>
  <p>error: failed to retrieve replica sets from deployment admin: replicasets.apps is forbidden: User &quot;ci-admin&quot; cannot list resource &quot;replicasets&quot; in API group &quot;apps&quot; in the namespace &quot;acceptance&quot;</p>
  </blockquote>
  <p>This was the original role configuration:</p>
  <pre><code># Server role that allows CI to push application deployments to Kubernetes
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: deployment-role
    namespace: acceptance
  rules:
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;deployments&quot;]
      resourceNames: [&quot;admin&quot;, &quot;backend&quot;, &quot;web&quot;]
      verbs: [&quot;patch&quot;, &quot;update&quot;, &quot;watch&quot;]
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;deployments&quot;]
      verbs: [&quot;get&quot;, &quot;list&quot;]
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;configmaps&quot;]
      resourceNames: [&quot;admin-fluent-bit-config&quot;, &quot;backend-fluent-bit-config&quot;, &quot;web-fluent-bit-config&quot;]
      verbs: [&quot;patch&quot;, &quot;update&quot;, &quot;watch&quot;]
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;configmaps&quot;]
      verbs: [&quot;get&quot;, &quot;list&quot;]
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;horizontalpodautoscalers&quot;]
      resourceNames: [&quot;backend&quot;]
      verbs: [&quot;delete&quot;, &quot;patch&quot;, &quot;update&quot;]
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;horizontalpodautoscalers&quot;]
      verbs: [&quot;create&quot;, &quot;get&quot;, &quot;list&quot;]
    - apiGroups: [&quot;*&quot;]
      resources: [&quot;events&quot;, &quot;pods&quot;, &quot;pods/log&quot;]
      verbs: [&quot;get&quot;, &quot;list&quot;]
  </code></pre>
  <p>I attempted to add permission to get and list replicasets to address the error:</p>
  <pre><code>  - apiGroups: [&quot;*&quot;]
      resources: [&quot;deployments&quot;, &quot;replicasets&quot;]
      verbs: [&quot;get&quot;, &quot;list&quot;]
  </code></pre>
  <p>but I’m still getting the same error as before.</p>
  <p>The Kubernetes documentation isn’t helpful at all, as there doesn’t appear to be any comprehensive list of what permissions are needed for any given command.  There’s only a handful of examples.</p>
  <p>Can anyone tell what permissions are needed for a rollback?</p>