I created a cluster role to view its events:
kubectl create clusterrole events-view -n my-namespace --verb get --resource events
kubectl create clusterrolebinding events-view -n my-namespace --group 'activedirectory_group://my-groups-canonical-name' --clusterrole events-view
But when I try to see events I get this:
> kubectl auth can-i get events -n my-namespace
yes
> kubectl get events -n my-namespace
Error from server (Forbidden): events is forbidden: User "u-wwrp76jtem" cannot list resource "events" in API group "" in the namespace "my-namespace"
This is the output of kubectl version
:
Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.8", GitCommit:"ec6eb119b81be488b030e849b9e64fda4caaf33c", GitTreeState:"clean", BuildDate:"2020-03-12T21:00:06Z", GoVersion:"go1.13.8", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"17", GitVersion:"v1.17.4", GitCommit:"8d8aa39598534325ad77120c120a22b3a990b5ea", GitTreeState:"clean", BuildDate:"2020-03-12T20:55:23Z", GoVersion:"go1.13.8", Compiler:"gc", Platform:"linux/amd64"}
Make sure the user u-wwrp76jtem
is part of the group activedirectory_group://my-groups-canonical-name
You should try below command to verify the groups permission
kubectl auth can-i get events -n my-namespace --as-group=activedirectory_group://my-groups-canonical-name