In-Cluster Permission

[kieronlanning]

Is there a way to give a specific service access to certain parts of the cluster?

I'm trying to do some basic service discovery from a service - which simply lists other service currently available based on some labels.

However, trying to make that call from within the cluster itself results in a 403 - Forbidden.

I'm accessing the cluster like so: var config = KubernetesClientConfiguration.InClusterConfig();

[brendandburns]

You need to look at (and configure) Service Account RBAC:

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

I'm going to close this since it is unrelated to the client library.

[kieronlanning]

@brendandburns You put me on to exactly the right path - thankyou!

[richardgragasin]

@brendandburns You put me on to exactly the right path - thankyou!

Hi, were you able to configure service account RBAC? i'm currently facing similar issue

[kieronlanning]

@richardgragasin Yes! We ended up with this:

open-api-rbac.yaml:

kind: ServiceAccount
metadata:
  name: open-api-account
  namespace: default
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: open-api-service-reader
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: open-api-service-reader
subjects:
  - kind: ServiceAccount
    # Reference to ServiceAccount kind's `metadata.name`
    name: open-api-account
    # Reference to ServiceAccount kind's `metadata.namespace`
    namespace: default
roleRef:
  kind: ClusterRole
  name: open-api-service-reader
  apiGroup: rbac.authorization.k8s.io

And then the Deployment kind looks a little like this:

Partial open-api-deployment.yaml:

kind: Deployment
metadata:
  name: open-api
  labels:
    name: open-api
    app: test-services
spec:
  strategy:
    type: RollingUpdate
  replicas: 1
  template:
    metadata:
      labels:
        name: open-api
        app: test-services
    spec:
      serviceAccountName: open-api-account
      containers:
      - name:  open-api
        image: open-api:$BUILD_ID

[richardgragasin]

@richardgragasin Yes! We ended up with this:

open-api-rbac.yaml:

kind: ServiceAccount
metadata:
  name: open-api-account
  namespace: default
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: open-api-service-reader
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: open-api-service-reader
subjects:
  - kind: ServiceAccount
    # Reference to ServiceAccount kind's `metadata.name`
    name: open-api-account
    # Reference to ServiceAccount kind's `metadata.namespace`
    namespace: default
roleRef:
  kind: ClusterRole
  name: open-api-service-reader
  apiGroup: rbac.authorization.k8s.io

And then the Deployment kind looks a little like this:

Partial open-api-deployment.yaml:

kind: Deployment
metadata:
  name: open-api
  labels:
    name: open-api
    app: test-services
spec:
  strategy:
    type: RollingUpdate
  replicas: 1
  template:
    metadata:
      labels:
        name: open-api
        app: test-services
    spec:
      serviceAccountName: open-api-account
      containers:
      - name:  open-api
        image: open-api:$BUILD_ID

Great! let me try this one. i hope this will work on me.