What happened?

RBAC doesn't work with create and resourceName

What did you expect to happen?

It should only allow the specified resourceName

How can we reproduce it (as minimally and precisely as possible)?

Make an RBAC policy with create limited to a resourceName

Anything else we need to know?

The user provided object contains the metadata.name for the object, so it should be possible to filter by resourceName when creating.

Kubernetes version

$ kubectl version
# paste output here

Cloud provider

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)