How can I figure out what role is missing in a service account?
Like I have the following:
kubectl auth can-i create taskrun --all-namespaces --as=system:serviceaccount:default:default
no
Ok, but where to go from here :-)
How can I figure out what role is missing in a service account?
Like I have the following:
kubectl auth can-i create taskrun --all-namespaces --as=system:serviceaccount:default:default
no
Ok, but where to go from here :-)
Posting the answer as community wiki, feel free to edit and expand.
As @mdaniel has already mentioned, there are no built-in tools in kubernetes which will figure out required access for a service account for you and then create a Role
and RoleBinding
.
As a temporary solution it can be used a clusterrole
- cluster-admin
, however best practice is to provide only minimun possible and required access rights.
Below are links to documentation which will be helpful:
API request verb - API verbs like get, list, create, update, patch, watch, delete, and deletecollection are used for resource requests