How do I give myself permission to create clusterrolebindings on Kubernetes?

1/22/2019

My command helm list is failing with the message:

Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"

And I found some results that tell me how to set up RBAC roles and rolebindings, like for example:

helm list : cannot list configmaps in the namespace "kube-system"

and

https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/

but these fail for me as well with this error:

Error from server (Forbidden): error when creating "tiller-clusterrolebinding.yaml": clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "$USER" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.

Now after some searching I found this answer:

Cannot create clusterrolebinding on fresh GKE cluster

Which gives this error:

ERROR: (gcloud.projects.add-iam-policy-binding) User [$USER] does not have permission to access project [$PROJECT:setIamPolicy] (or it may not exist): The caller does not have permission

This last error finally seems to give me a good tip, I seem to not be an administrator/owner of this project, so I'm asking the owner of the project if he can give me those permissions. He's non-technical, so he'll have to do it through the GUI.

-- Tinco
google-kubernetes-engine
kubernetes
kubernetes-helm
rbac

1 Answer

1/22/2019

You would need one of the following roles to create clusterrolebindings in k8s:

  • Owner
  • Kubernetes Engine Admin
  • Composer Worker

You can check permissions and roles in Roles tab in GCP

roles

And you can assign one of these roles (or create a custom role) in IAM & Admin Tab

enter image description here

You need one of the following roles with resourcemanager.projects.setIamPolicy permission to set IAM policy roles for somebody else (which I believe your admin does)

  • Organization Administrator
  • Owner
  • Project IAM Admin

enter image description here

Your project owner, organization administrator, or somebody with project IAM admin role will need to give your $USER one of the following roles, or create a custom role: Owner (less likely), Kubernetes Engine Admin (most likely, not following the security principle of least privilege though) or Composer Worker. Then your $USER will be able to create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope

-- edbighead
Source: StackOverflow