Kubernetes understanding output of - kubectl auth can-i

user_9141593 0
Viewed 1147

I'm trying to understand why on one cluster an operation is permitted but on the other i'm getting the following

Exception encountered setting up namespace watch from Kubernetes API v1 endpoint https://10.100.0.1:443/api: namespaces is forbidden: User \"system:serviceaccount:kube-system:default\" cannot list resource \"namespaces\" in API group \"\" at the cluster scope ({\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"namespaces is forbidden: User \\\"system:serviceaccount:kube-system:default\\\" cannot list resource \\\"namespaces\\\" in API group \\\"\\\" at the cluster scope\",\"reason\":\"Forbidden\",\"details\":{\"kind\":\"namespaces\"},\"code\":403}\n)"

I'm managing two Kubernetes clusters -

clusterA booted with Kops version v1.14.8

clusterB booted on AWS EKS version v1.14.9-eks-f459c0

So i've tried using the kubectl auth command to try figuring out and I do see that on one i'm allowed however on the second i'm not as you can see:

kubectl config use-context clusterA
Switched to context "clusterA".
kubectl auth can-i list pods --as=system:serviceaccount:kube-system:default -n kube-system
yes
kubectl config use-context clusterB
Switched to context "clusterB".
kubectl auth can-i list pods --as=system:serviceaccount:kube-system:default -n kube-system
no

Is there a way to understand what are these two decisions based on yes/no? Thanks for helping out!

amazon-eks kubectl kubernetes
1 Answers

The decision yes/no is based on whether there is a clusterrole and a clusterrolebinding or rolebinding which permits the default serviceaccount in kube-system namespace to perform verb list on resource namespace.

The trick in case of namespace resource is that there needs to be a clusterrole instead of role because namespace is a cluster scoped resource.

You check what are the clusterrole,role, clusterrolebinding,rolebinding exists in a kubernetes cluster using below command

kubectl get clusterrole,clusterrolebinding
kubectl get role,rolebinding -n namespacename

For more details refer Kubernetes RBAC here

user_18394820
Related