Read configmap from a k8s program

Question

I’ve a go program which need to access to config map, when using the following clusterRole we got error forbidden

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: s-access
 labels:
  app.kubernetes.io/instance: te-mger
rules:
 - verbs:
   - get
   - watch
   - list
   - update
  apiGroups:
   - dpt.com
  resources:
   - pods

Now when I change it to the following it works, (adding apiGroups '') and configmaps to the resources As this is a workaround what should we do for long solutions

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: s-access
 labels:
  app.kubernetes.io/instance: te-mger
rules:
 - verbs:
   - get
   - watch
   - list
   - update
  apiGroups:
   - dpt.com
   - ''
  resources:
   - pods
   - configmaps

I read the following but it didnt help https://kubernetes.io/docs/reference/access-authn-authz/rbac/

I want to avoid using apiGroups: ''

user_8607826 · Answer

Each Kubernetes resource is part of some API group. The API group defines the path on which these resources are available. You can find them for example in the Kubernetes API reference (for each resource you have the group, version and kind).

As you can see here, for example for ConfigMap the group is core. The group into which the resource belongs needs to be used in the ClusterRole (or Role) when referencing the resources. That is needed to properly specify which resource you are talking about since the resource name is not necessarily unique on its own but only in combination with the group.

Normally, the group is just written there, but for the core group, you normally just put there "" (as described here).

So in your examples, this:

rules:
  - verbs:
      - get
      - watch
      - list
      - update
    apiGroups:
      - dpt.com
    resources:
      - configmaps

would cover some resources named pod and configmap from your own API group dsp.com but not the real Kubernetes resources from the core group. To cover them you need to specify the right group like this:

rules:
  - verbs:
      - get
      - watch
      - list
      - update
    apiGroups:
      - ""
    resources:
      - configmaps

If you would want to give access only to specific ConfigMap, you can use the resourceNames field.

rules:
  - verbs:
      - get
      - watch
      - list
      - update
    apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - my-config-map
      - my-config-map

But you need to name the config maps one by one. It does not support any wildcards, regular expressions or anything.

Read configmap from a k8s program

1 Answers