k8s API Access through python inside the pod

Answering the question, I think there are some things that should be considered:

• Indentation
• Service account running the Pod
• Python code and access scopes

As there is no minimal, reproducible example we can at most assume on how exactly you've configured your setup.

Indentation

The YAML manifest that you've included will is not indented correctly. The correct manifest should look like below:

• full.yaml:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: myaccount
  namespace: dev
---          
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev
  name: pods-reader-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: pod-controller
  namespace: dev
subjects:
- kind: ServiceAccount
  name: myaccount
  apiGroup: ""
roleRef:
  kind: Role
  name: pods-reader-role
  apiGroup: ""

A side note!

Consider creating more restrictive Role for your use case as it's allowing to do everything in the dev namespace.

Service account running the Pod

The potential issue here is that you've created a serviceAccount with a name: myaccount and the Pod is trying to authenticate using the deploy-svc-account. (User \"system:serviceaccount:dev:deploy-svc-account\" cannot list resource)

Please ensure that the correct serviceAccount is used to run a Pod.

Example:

apiVersion: v1
kind: Pod
metadata:
  name: sdk
  namespace: dev
spec:
  serviceAccountName: myaccount # <-- IMPORTANT
  containers:
  - image: google/cloud-sdk
    command:
      - sleep
      - "infinity"
    imagePullPolicy: IfNotPresent
    name: sdk
  restartPolicy: Always

Python code and access scopes

Assuming that you've used the code from the documentation page of Kubernetes Python API library ("Listing pods with their IPs:"):

• Github.com: Kubernetes client: Python

There are 2 topics to consider here:

• Access scopes
• Querying the resources

Citing the official documentation:

A Role always sets permissions within a particular namespace; when you create a Role, you have to specify the namespace it belongs in.

Kubernetes.io: Docs: Reference: RBAC: Role and ClusterRole

The permissions that you've assigned by a Role and a RoleBinding are for dev namespace only. If you would like to have full cluster scope you would need to create a ClusterRole and a ClusterRoleBinding.

I encourage you to check the documentation included in the citation as it has some examples to follow and there are many explanations on that matter.

Also, a word about the Python code:

from kubernetes import client, config

# Configs can be set in Configuration class directly or using helper utility
config.load_incluster_config()

v1 = client.CoreV1Api()
print("Listing pods with their IPs:")
ret = v1.list_pod_for_all_namespaces(watch=False)
for i in ret.items:
    print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))

Focusing on:

ret = v1.list_pod_for_all_namespaces(watch=False)

This code will query for Pods from all namespaces, that's why you've also receiving the error cannot list resource \"pods\" in API group \"\" at the cluster scope".

To list the Pods from a specific namespace you can use:

ret = v1.list_namespaced_pod(namespace="dev", watch=False)

And by that you should be able to get:

• python3 program.py:

Listing pods with their IPs:
10.32.0.15  dev sdk