Kubernetes cluster role with permissions to watch events

Question

I'm trying to create a cluster role with permissions to watch events, but it seems that I'm missing something.

I'm using the following:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: watch-events
  namespace: test
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: watch-events-cluster
rules:
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: watch-events-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: watch-events-cluster
subjects:
- kind: ServiceAccount
  name: watch-events
  namespace: test

No mater what I try with kubectl auth can-i watch events --as watch-events I always get a no.

Am I missing something?

user_1839482 · Answer

The RBAC is correct and will give cluster wide permission to watch events across all namespaces but the kubectl command is incorrect.The command should be

kubectl auth can-i watch events --as=system:serviceaccount:test:watch-events

user_999943 · Answer

If you are making api calls against the swagger api for Kubernetes, you need to specify the Events api group properly with the suffix .k8s.io

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#-strong-api-groups-strong-

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: my-custom-role
  namespace: default
rules:
  - apiGroups:
      - ''
      - events.k8s.io
    resources:
      - events
    verbs:
      - '*'
---

user_498256 · Answer

https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions

Default RBAC policies grant scoped permissions to control-plane components, nodes, and controllers, but grant no permissions to service accounts outside the kube-system namespace (beyond discovery permissions given to all authenticated users).

Kubernetes cluster role with permissions to watch events

3 Answers