Role created with field resourceNames does not allow to view specific resources.

4.12

100%

1. Create a new-project(oc new-project test), then create 2 new-apps(oc new-app httpd and oc new-app httpd --name=apache)
2. Create a role with below rule to provide edit access to pods and deployment.
~~~
kind: Role
metadata:
  name: role-test
  namespace: test-secret
rules:
- apiGroups:
  - ""
  resources:
  - pods/exec
  - pods
  - pods/log
  - pods/status
  verbs:
  - get
  - list
  - create
- apiGroups:
  - metrics.k8s.io
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  - apps
  resources:
  - deployments
  - deployments/scale
  - deployments/status
  verbs:
  - get
  - list
  - watch
  - update
  - patch
  - create
- apiGroups:
  - ""
  - project.openshift.io
  resources:
  - projects
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - namespaces
  - namespaces/status
  verbs:
  - get
  - list
  - watch
~~~
3. Now view from GUI and CLI it works fine.
4. Edit the role and add deployment httpd as resourceNames and it fails with below error.
~~~
oc edit role role-test

- apiGroups:
  - ""
  - apps
  resourceNames:
  - httpd
  resources:
  - deployments
  - deployments/scale
  - deployments/status
  verbs:

~~~
~~~
deployments.apps is forbidden: User "user1" cannot list resource "deployments" in API group "apps" in the namespace "test-secret"
~~~

5. But same thing from CLI, if we check by giving the deployment name it works but when checking all the deployment it fails. 
~~~
$ oc get deployment httpd
NAME    READY   UP-TO-DATE   AVAILABLE   AGE
httpd   1/1     1            1           28m

$ oc get deployment
Error from server (Forbidden): deployments.apps is forbidden: User "user1" cannot list resource "deployments" in API group "apps" in the namespace "test-secret"

$ oc get deployment apache
Error from server (Forbidden): deployments.apps "apache" is forbidden: User "user1" cannot get resource "deployments" in API group "apps" in the namespace "test-secret"

The deployment list is not returned when checking from both CLI and GUI
~~~
$ oc get deployment 
Error from server (Forbidden): deployments.apps is forbidden: User "user1" cannot list resource "deployments" in API group "apps" in the namespace "test-secret"
~~~

The deployment list should show the name of deployment on which the user has access.