K
Q

Restrict ServiceAccount / Role to manage secrets in all clusters

12/17/2019

I'm trying to restrict a ServiceAccount's RBAC permissions to manage secrets in all namespaces:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab-secrets-manager
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  resourceNames:
  - gitlab-registry
  verbs:
  - get
  - list
  - create
  - update
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-service-account
  namespace: gitlab
secrets:
- name: gitlab-service-account-token-lllll
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-service-account-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gitlab-secrets-manager
subjects:
- kind: ServiceAccount
  name: gitlab-service-account
  namespace: gitlab

So far, I've created the ServiceAccount and the related CRB, however, actions are failing:

secrets "gitlab-registry" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "secrets" in API group "" in the namespace "shamil"

Anyone know what I'm missing?

-- bear
kubernetes
rbac

Similar Questions

How to update kubernetes-dashboard with kubespray
Create kubernetes resources with helm only if custom resource definition exists
How can I modify my kubernetes config file which is separated from my employed company cluster for adding second cluster?
Unable to helm install due to deployment manifest issue
Launch worker node on the same machine as master node

1 Answer

12/18/2019

You can do the following steps:

  • At first, you need to insure that your serviceaccount named gitlab-service-account in gitlab namespace exists in the cluster.
  • Then you will create a ClusterRole as you have given:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab-secrets-manager
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - gitlab-registry
    verbs:
      - get
      - list
      - create
      - update
  • Then you will also create a ClusterRoleBinding to grant permission at the cluster level.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-secrets-manager-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: gitlab-service-account    
    namespace: gitlab
roleRef:
  kind: ClusterRole
  name: gitlab-secrets-manager
  apiGroup: rbac.authorization.k8s.io
-- Sayf Uddin Al Azad Sagor
Source: StackOverflow