Kubernetes auth failure when getting namespace

Question

I attempting to run a get operation on a specific namespace from within the runtime of a pod. I am using the golang client and using the in-cluster configuration when doing so.

I have created a ClusterRole and ClusterRoleBinding to a service account. The error message we are receiving is also mentioning the service account name and stating that it does not have sufficient permissions.

Relevant snippet of go code:

// Getter logic
    _, err := client.
        Resource(runtimeschema.GroupVersionResource{Version: "v1", Resource: "namespace"}).
        Get(ctx, 'cool-namespace', metav1.GetOptions{})
    if err != nil {
        return err
    }

Snippet of kubectl describe on the ClusterRole:

PolicyRule:
  Resources   Non-Resource URLs  Resource Names                   Verbs
  ---------   -----------------  --------------                   -----
  namespaces  []                 [cool-namespace]                 [get]

Now the part that really confuses me. I assumed the issue would be in how we were binding the clusterrole or attaching the service account to the pod, but the error received on runtime is...

namespace \"cool-namespace\" is forbidden: User \"system:serviceaccount:cert-manager:cert-manager-service-account\" cannot get resource \"namespace\" in API group \"\" in the namespace \"cool-namespace\"", "errorVerbose": "namespace \"cool-namespace\" is forbidden

additionally, if we try to use kubectl impersonation we can see the following:

$ kubectl get namespace/cool-namespace --as=system:serviceaccount:cert-manager:cert-manager-service-account
NAME                STATUS   AGE
cool-namespace      Active   5d20h

It seems like the service account is appropriately permissioned, and that same service account shows up as being used in the error logs when receiving the forbidden error. Been staring at this for a while and feel like I'm missing something super basic. Thanks for the help!

Kubernetes auth failure when getting namespace

0 Answers