How to resolve error: cannot get resource "daemonsets" in API group "apps" in the namespace "kube-system"

cloudbud 0
Viewed 28

I have a job that is deployed in kube-system ns and which is trying to set some variables in the aws-node daemon set.

But I am getting this error:

Error from server (Forbidden): daemonsets.apps "aws-node" is forbidden: User "system:serviceaccount:kube-system:default" cannot get resource "daemonsets" in API group "apps" in the namespace "kube-system"

The job manifest is :

apiVersion: batch/v1
kind: Job
metadata:
  name: vpc-cni-add-on
  labels:
    name: vpc-cni-add-on
spec:
  template:
    metadata:
      name: vpc-cni-add-on
    spec:
      containers:
      - name: add-on
        image: bitnami/kubectl
        command: ["/bin/bash"]
        args: ["-c","kubectl set env daemonset aws-node -n kube-system ENABLE_POD_ENI=true"]
      restartPolicy: Never
kubernetes-jobs kubernetes-pod kubernetes
1 Answers

You can verify once by assigning the RBAC cluster-admin rule to service account.

Create service account

kubectl create serviceaccount --namespace kube-system cronjob-sa

Attach cluster-role to service account.

kubectl create clusterrolebinding cronjob-sa-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:cronjob-sa

use the service account with job and run it again.

serviceAccountName : cronjob-sa

else

Assign access to the user also directly

kubectl create clusterrolebinding --user system:serviceaccount:kube-system:default user-cluster-admin --clusterrole cluster-admin
Harsh Manvar0
Related