CODEWITHSUNDEEP
kubernetes
Michael Cole
Michael Cole

Reputation: 16257

Kubernetes RBAC configuration w/ nodejs client

My design is: EventController lives in "default" namespace and starts Jobs in "gamespace" namespace.

I'm getting this error trying to create a Job with the Node.js kubernetes client:

jobs.batch is forbidden: User "system:serviceaccount:default:event-manager" cannot create resource "jobs" in API group "batch" in the namespace "gamespace"

from this line of code:

const job = await batchV1Api.createNamespacedJob('gamespace', kubeSpec.job)

kubeSpec.job is:

 {
  apiVersion: 'batch/v1',
  kind: 'Job',
  metadata: {
    name: 'event-60da4bee95e237001d65e355',
    namespace: 'gamespace',
    labels: {
      tier: 'event-servers',
    }
  },
  spec: {
    backoffLimit: 1,
    activeDeadlineSeconds: 14400,
    ttlSecondsAfterFinished: 86400,
    template: { spec: [Object] }
  }
}

And here's my RBAC configuration:

apiVersion: v1
kind: Namespace
metadata:
  name: gamespace

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: event-manager

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: event-manager-role
rules:
  - apiGroups: ['', 'batch'] # '' means "core"
    resources: ['jobs', 'services']
    verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: event-manager-clusterrole-binding
  # Specifies the namespace the ClusterRole can be used in.
  namespace: gamespace
subjects:
  - kind: ServiceAccount
    name: event-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: event-manager-role

The container making the function call is configured like this:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eventcontroller-deployment
  labels:
    app: eventcontroller
spec:
  selector:
    matchLabels:
      app: eventcontroller
  replicas: 1
  template:
    metadata:
      labels:
        app: eventcontroller
    spec:
      # see accounts-namespaces.yaml
      serviceAccountName: 'event-manager'
      imagePullSecrets:
        - name: registry-credentials
      containers:
        - name: eventcontroller
          image: eventcontroller
          imagePullPolicy: Always
          envFrom:
            - configMapRef:
                name: eventcontroller-config
          ports:
            - containerPort: 3003

I'm not sure if I'm using the client incorrectly (why is namespace needed in the spec and the function call?), or if I've configured RBAC incorrectly.

Any suggestions?

Thank you!

Upvotes: 0

Views: 311

Answers (1)

Lukonjun
Lukonjun

Reputation: 286

I can't comment so I will share some Ideas what could be an Issue and how i would further debug the problem.

For your Deployment you have no Namespace defined, could it be the case that the Pod is running in a different Namespace (!= gamespace), but your Service Account only applies for gameplay?

A RoleBinding grants permissions within a specific namespace1

If this is not the error you might want to try to use a service account that is already created and gives all permissions for the start to rule out other errors.

Here an Example Manifest

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: all-permissions
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: service-account-all-permissions
    namespace: gameplay

Set the Service Account to 'service-account-all-permissions' in your Deployment and see if you still get an permission error from the Kubernetes API

Source.

Upvotes: 2

Related Questions