CODEWITHSUNDEEP
kubernetesrbac
Simon Ernesto Cardenas Zarate
Simon Ernesto Cardenas Zarate

Reputation: 2942

why i can't create pods a a user with enough permissions in kubernetes

I am following a tutorial regarding RBAC, I think I understand the main idea but I don't get why this is failing:

kc auth can-i "*" pod/compute --as [email protected]
no

kc create clusterrole deploy --verb="*" --resource=pods --resource-name=compute
clusterrole.rbac.authorization.k8s.io/deploy created

kc create clusterrolebinding deploy [email protected] --clusterrole=deploy
clusterrolebinding.rbac.authorization.k8s.io/deploy created

# this tells me that [email protected] should be able to create a pod named compute
kc auth can-i "*" pod/compute --as [email protected]
yes

# but it fails when trying to do so
kc run compute --image=nginx --as [email protected]
Error from server (Forbidden): pods is forbidden: User "[email protected]" cannot create resource "pods" in API group "" in the namespace "default"

the namespace name should be irrelevant afaik, since this is a clusterrole.

Upvotes: 1

Views: 332

Answers (1)

whites11
whites11

Reputation: 13260

Restricting the create permission to a specific resource name is not supported.

This is from the Kubernetes documentation:

Note: You cannot restrict create or deletecollection requests by resourceName. For create, this limitation is because the object name is not known at authorization time.

This means the ClusterRole you created doesn't allow you to create any Pod. You need to have another ClusterRole assigned where you don't specify the resource name.

Upvotes: 2

Related Questions