Kubernetes RBAC authentication for default user

3
votes

I am using kops in AWS to create my Kubernetes cluster.

I have created a cluster with RBAC enabled via --authorization=RBAC as described here.

I am trying to use the default service account token to interact with the cluster and getting this error:

Error from server (Forbidden): User "system:serviceaccount:default:default" cannot list pods in the namespace "default". (get pods)

Am I missing a role or binding somewhere?

2
kubernetesrbackubectlkops
You can check all clusterroles and clusterrolebindings by command: kubectl get clusterrolebinding -o wide. – waldauf

2 Answers

2
votes

I thing it is not a good idea to give the cluster-admin role to default service account in default namespace.

If you will give cluster-admin access to default user in default namespace - every app (pod) that will be deployed in cluster, in default namespace - will be able to manipulate the cluster (delete system pods/deployments or make other bad stuff).

By default the clusterrole cluster-admin is given to default service account in kube-system namespace. You can use it for interacting with cluster.

0
votes

try to give admin role and try.

kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin  --serviceaccount=default:default