I am baffled. kubectl says I can (via the
kubectl auth can-i subcommand), but then when I go to perform the action, I can't.
I have installed
kubectl on a docker image which is running on a pod managed by a
Deployment. When I
kubectl exec -it into that pod (which only has a single container) I get this.
user@my-pod:~$ kubectl auth can-i get secrets -n myNamespace yes user@my-pod:~$ kubectl get secrets -n myNamespace Error from server (Forbidden): secrets is forbidden: User "system:serviceaccount:myNamespace:myServiceAccount" cannot list resource "secrets" in API group "" in the namespace "myNamespace"
Here is how my serviceaccount is configured
--- apiVersion: v1 kind: ServiceAccount metadata: name: myServiceAccount namespace: myNamespace --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: myRole namespace: myNamespace rules: - apiGroups: [""] resources: ["secrets"] verbs: ["get", "describe"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: myRoleBinding namespace: myNamespace roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: myRole subjects: - kind: ServiceAccount name: myServiceAccount namespace: myNamespace
I am first of all curious to know if I am using
kubectl auth can-i incorrectly.
Secondly, I would like to be able to authorize this serviceaccount to make this API call. Is there a misconfiguration in my yaml?