URL: /apis/apps/v1/namespaces/diyclientapps/deployments
) "{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"deployments.apps is forbidden: User \"system:serviceaccount:default:default\" cannot create deployments.apps in the namespace \"diyclientapps\"","reason":"Forbidden","details":{"group":"apps","kind":"deployments"},"code":403}
I'm getting the above error when trying to create a deployment via the Kubernetes REST API.
Why? I don't understand the error message...
This occurs on a custom Kubernetes cluster... The above worked correctly on a local Minikube instance.
I can successfully create a deployment via: kubectl run hello-minikube --image=k8s.gcr.io/echoserver:1.4 --port=8080
WARNING: This allows any user with read access to secrets or the ability to create a pod to access super-user credentials.
kubectl create clusterrolebinding serviceaccounts-cluster-admin \
--clusterrole=cluster-admin \
--group=system:serviceaccountsIt likely worked on minikube because it set up a permissive (insecure) policy for you.
See https://kubernetes.io/docs/admin/authorization/rbac/#service-account-permissions for information about granting permissions to service accounts.
Default RBAC policies grant scoped permissions to control-plane components, nodes, and controllers, but grant no permissions to service accounts outside the “kube-system” namespace (beyond discovery permissions given to all authenticated users).