Search code examples
kuberneteskubectlkubernetes-helm

Run kubectl inside a cluster

I have a Kubernetes 1.10 cluster up and running. Using the following command, I create a container running bash inside the cluster:

kubectl run tmp-shell --rm -i --tty --image centos -- /bin/bash

I download the correct version of kubectl inside the running container, make it executable and try to run

./kubectl get pods

but get the following error:

Error from server (Forbidden): pods is forbidden:
User "system:serviceaccount:default:default" cannot
list pods in the namespace "default"

Does this mean, that kubectl detected it is running inside a cluster and is automatically connecting to that one? How do I allow the serviceaccount to list the pods? My final goal will be to run helm inside the container. According to the docs I found, this should work fine as soon as kubectl is working fine.

Solution

  • Does this mean, that kubectl detected it is running inside a cluster and is automatically connecting to that one?

    Yes, it used the KUBERNETES_SERVICE_PORT and KUBERNETES_SERVICE_HOST envvars to locate the API server, and the credential in the auto-injected /var/run/secrets/kubernetes.io/serviceaccount/token file to authenticate itself.

    How do I allow the serviceaccount to list the pods?

    That depends on the authorization mode you are using. If you are using RBAC (which is typical), you can grant permissions to that service account by creating RoleBinding or ClusterRoleBinding objects.

    See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions for more information.

    I believe helm requires extensive permissions (essentially superuser on the cluster). The first step would be to determine what service account helm was running with (check the serviceAccountName in the helm pods). Then, to grant superuser permissions to that service account, run: 

    kubectl create clusterrolebinding helm-superuser \
  --clusterrole=cluster-admin \
  --serviceaccount=$SERVICEACCOUNT_NAMESPACE:$SERVICEACCOUNT_NAME