How to provide access to a pod so that it can list and get other pods and other resource in the namespaces/cluster

Question

I have been working on creating a application which can perform verification test on the deployed istio components in the kube-cluster. The constraint in my case is that I have run this application as a pod inside the kubernetes and I cannot provide cluster-admin role to the pod of the application so that it can do all the operations. I have to create a restricted ClusterRole just to provide enough access so that application list and get all the required deployed istio resources (Reason for creating a cluster role is because when istio is deployed it created both namespace level and cluster level resources). Currently my application won't run at all if I use my restricted ClusterRole and outputs and error

Error: failed to fetch istiod pod, error: pods is forbidden: User "system:serviceaccount:istio-system:istio-deployment-verification-sa" cannot list resource "pods" in API group "" in the namespace "istio-system"

Above error doesn't make sense as I have explicitly mentioned the core api group in my ClusterRole and also mentioned pods as a resource in the resourceType child of my ClusterRole definition.

Clusterrole.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Values.clusterrole.name }}
  namespace: {{ .Values.clusterrole.clusterrolens}}
rules:
- apiGroups:
  - "rbac.authorization.k8s.io"
  - "" #enabling access to core API
  - "networking.istio.io"
  - "install.istio.io"
  - "autoscaling"
  - "apps"
  - "admissionregistration.k8s.io"
  - "policy"
  - "apiextensions.k8s.io"
  resources:
  - "clusterroles"
  - "clusterolebindings"
  - "serviceaccounts"
  - "roles"
  - "rolebindings"
  - "horizontalpodautoscalers"
  - "configmaps"
  - "deployments"
  - "mutatingwebhookconfigurations"
  - "poddisruptionbudgets"
  - "envoyfilters"
  - "validatingwebhookconfigurations"
  - "pods"
  - "wasmplugins"
  - "destinationrules"
  - "envoyfilters"
  - "gateways"
  - "serviceentries"
  - "sidecars"
  - "virtualservices"
  - "workloadentries"
  - "workloadgroups"
  - "authorizationpolicies"
  - "peerauthentications"
  - "requestauthentications"
  - "telemetries"
  - "istiooperators"
  resourceNames:
  - "istiod-istio-system"
  - "istio-reader-istio-system"
  - "istio-reader-service-account"
  - "istiod-service-account"
  - "wasmplugins.extensions.istio.io"
  - "destinationrules.networking.istio.io"
  - "envoyfilters.networking.istio.io"
  - "gateways.networking.istio.io"
  - "serviceentries.networking.istio.io"
  - "sidecars.networking.istio.io"
  - "virtualservices.networking.istio.io"
  - "workloadentries.networking.istio.io"
  - "workloadgroups.networking.istio.io"
  - "authorizationpolicies.security.istio.io"
  - "peerauthentications.security.istio.io"
  - "requestauthentications.security.istio.io"
  - "telemetries.telemetry.istio.io"
  - "istiooperators.install.istio.io"
  - "istiod"
  - "istiod-clusterrole-istio-system"
  - "istiod-gateway-controller-istio-system"
  - "istiod-clusterrole-istio-system"
  - "istiod-gateway-controller-istio-system"
  - "istio"
  - "istio-sidecar-injector"
  - "istio-reader-clusterrole-istio-system"
  - "stats-filter-1.10"
  - "tcp-stats-filter-1.10"
  - "stats-filter-1.11"
  - "tcp-stats-filter-1.11"
  - "stats-filter-1.12"
  - "tcp-stats-filter-1.12"
  - "istio-validator-istio-system"
  - "istio-ingressgateway-microservices"
  - "istio-ingressgateway-microservices-sds"
  - "istio-ingressgateway-microservices-service-account"
  - "istio-ingressgateway-public"
  - "istio-ingressgateway-public-sds"
  - "istio-ingressgateway-public-service-account"
  verbs:
  - get
  - list

Application I have built leverage the istioctl docker container published by istio on dockerhub. Link.

I want to understand what changes are required in above ClusterRole definition so that I can perform the get and list operations for the pods in the namespace.

I would also want to understand that is it possible that the error I am getting is trying to reference some other resource in the cluster?

Cluster information:

Kubernetes version: 1.20
Istioctl docker image version: 1.12.2
Istio version: 1.12.1

Answer 1

As OP mentioned in the comment problem is resolved after my suggestion:

Please run the command kubectl auth can-i list pods --namespace istio-system --as system:serviceaccount:istio-system:istio-deployment-verification-sa and attach result to the question. Look also here

OP has confirmed that problem is resolved:

thanx for the above command using above I was finally able to nail down the issue and found the issue to be with first resourceName and second we need to mention core api in the api group before any other. Thank you issue is resolved now.