K
Q

Kubernetes returns Forbidden even if RBAC permissions are set

8/27/2018

I'm trying to create a proper set of permissions for a serviceAccount. For some reason it seems to ignore the permissions I granted and gives me a bunch of errors because of that. I don't see what I did wrong. Did I apply something in the wrong namespace or similar?

My Role:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: r-wercker-ingress-new
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: ["extensions"]
  resources: ["deployments"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]

My RoleBinding:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: r-wercker-ingress-new
subjects:
- kind: ServiceAccount
  name: wercker
  namespace: kube-ingress
roleRef:
  kind: Role
  name: r-wercker-ingress-new
  apiGroup: rbac.authorization.k8s.io

kubectl output about role

kubectl describe role r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"default"},"rules":[...
PolicyRule:
  Resources                             Non-Resource URLs  Resource Names  Verbs
  ---------                             -----------------  --------------  -----
  configmaps                            []                 []              [create delete patch update get watch list]
  deployments.extensions                []                 []              [create delete patch update get watch list]
  horizontalpodautoscalers.autoscaling  []                 []              [create delete patch update get watch list]
  namespaces                            []                 []              [create delete patch update get watch list]
  serviceaccounts                       []                 []              [create delete patch update get watch list]
  services                              []                 []              [create delete patch update get watch list]

kubectl output about RoleBinding

kubectl describe rolebinding r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"default"},"r...
Role:
  Kind:  Role
  Name:  r-wercker-ingress-new
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  wercker  kube-ingress

Error output when trying to apply my resources:

Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d380 0xc4205982a0  kube-ingress resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4370  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": namespaces "kube-ingress" is forbidden: User "system:serviceaccount:default:wercker" cannot get namespaces in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d440 0xc420599340 kube-ingress nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc420df43f8  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": serviceaccounts "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get serviceaccounts in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d680 0xc4201e55e0  nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4500  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": clusterroles.rbac.authorization.k8s.io "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get clusterroles.rbac.authorization.k8s.io at the cluster scope
Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d740 0xc4204c4770  nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4578  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": clusterrolebindings.rbac.authorization.k8s.io "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get clusterrolebindings.rbac.authorization.k8s.io at the cluster scope
Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d800 0xc4204c5e30 kube-ingress ingress-nginx resources/kube-ingress/ingress-controller-nginx.yml 0xc420df45f0  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": services "ingress-nginx" is forbidden: User "system:serviceaccount:default:wercker" cannot get services in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d8c0 0xc420134a10 kube-ingress ingress-nginx resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4660  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": configmaps "ingress-nginx" is forbidden: User "system:serviceaccount:default:wercker" cannot get configmaps in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42062d980 0xc420145ab0 kube-ingress ingress-nginx resources/kube-ingress/ingress-controller-nginx.yml 0xc420df46f0  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": deployments.extensions "ingress-nginx" is forbidden: User "system:serviceaccount:default:wercker" cannot get deployments.extensions in the namespace "kube-ingress"

Edit 1: I tried moving the resources into the corresponding namespaces but still get the same errors.

kubectl --namespace kube-ingress get role
NAME                    AGE
r-wercker-ingress-new   2m

kubectl --namespace kube-ingress describe role r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"kube-ingress"},"rul...
PolicyRule:
  Resources                             Non-Resource URLs  Resource Names  Verbs
  ---------                             -----------------  --------------  -----
  configmaps                            []                 []              [create delete patch update get watch list]
  deployments.extensions                []                 []              [create delete patch update get watch list]
  horizontalpodautoscalers.autoscaling  []                 []              [create delete patch update get watch list]
  namespaces                            []                 []              [create delete patch update get watch list]
  serviceaccounts                       []                 []              [create delete patch update get watch list]
  services                              []                 []              [create delete patch update get watch list]

kubectl --namespace kube-ingress get rolebinding
NAME                              AGE
r-wercker-ingress-new             2m

kubectl --namespace kube-ingress describe rolebinding r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"kube-ingress...
Role:
  Kind:  Role
  Name:  r-wercker-ingress-new
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  wercker  kube-ingress

Still gives:

Error from server (Forbidden): error when retrieving current configuration of:
&{0xc420d14840 0xc420382620 kube-ingress nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc42160e560  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": serviceaccounts "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get serviceaccounts in the namespace "kube-ingress"

I have deleted and re-created the Roles and RoleBindings

-- soupdiver
kubernetes
rbac

Similar Questions

Why is running distrubuted tensorflow on kubernetes much slower than running locally?
Istio End User Authentication with JWT on a GRPC service
Istio distributed tracing with Jaeger not working
Kubernetes share a directory from your local system to kubernetes container

2 Answers

8/27/2018

Yes, it looks like you are applying the resources into a wrong namespace. If you want to set these permissions up for the namespace kube-ingress, you need to create the resources in this namespace.

So you would add this line to the metadata of your Role, RoleBinding and ServiceAccount:

namespace: kube-ingress

Using Role and RoleBinding, you define permissions for a single namespace. If you would like to create cluster-wide permissions, you can use ClusterRole and ClusterRoleBinding.

You can also create a common case ClusterRole and then bind it to a single namespace with RoleBinding. The k8s docs are very helpful in this regard: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole

-- EyfI
Source: StackOverflow
8/27/2018

As discussed in the Kubernetes slack channel, you have to specify the namespace.

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: r-wercker-ingress-new
  namespace: kube-ingress
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: ["extensions"]
  resources: ["deployments"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
-- Josbrafe
Source: StackOverflow