I’ve a go program which need to access to config map, when using the following clusterRole we got error forbidden
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: s-access
labels:
app.kubernetes.io/instance: te-mger
rules:
- verbs:
- get
- watch
- list
- update
apiGroups:
- dpt.com
resources:
- pods
Now when I change it to the following it works, (adding apiGroups '') and configmaps to the resources
As this is a workaround what should we do for long solutions
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: s-access
labels:
app.kubernetes.io/instance: te-mger
rules:
- verbs:
- get
- watch
- list
- update
apiGroups:
- dpt.com
- ''
resources:
- pods
- configmaps
I read the following but it didnt help https://kubernetes.io/docs/reference/access-authn-authz/rbac/
I want to avoid using apiGroups: ''
Each Kubernetes resource is part of some API group. The API group defines the path on which these resources are available. You can find them for example in the Kubernetes API reference (for each resource you have the group, version and kind).
As you can see here, for example for ConfigMap the group is core. The group into which the resource belongs needs to be used in the ClusterRole (or Role) when referencing the resources. That is needed to properly specify which resource you are talking about since the resource name is not necessarily unique on its own but only in combination with the group.
Normally, the group is just written there, but for the core group, you normally just put there "" (as described here).
So in your examples, this:
rules:
- verbs:
- get
- watch
- list
- update
apiGroups:
- dpt.com
resources:
- configmaps
would cover some resources named pod and configmap from your own API group dsp.com but not the real Kubernetes resources from the core group. To cover them you need to specify the right group like this:
rules:
- verbs:
- get
- watch
- list
- update
apiGroups:
- ""
resources:
- configmaps
If you would want to give access only to specific ConfigMap, you can use the resourceNames field.
rules:
- verbs:
- get
- watch
- list
- update
apiGroups:
- ""
resources:
- configmaps
resourceNames:
- my-config-map
- my-config-map
But you need to name the config maps one by one. It does not support any wildcards, regular expressions or anything.