Home / server / Questions / 1080544
In Process
Chris G.
Asked: 2021-10-15 05:25:24 +0800 CST

How to know what roles are missing in RBAC

  • 772

How can I figure out what role is missing in a service account?

Like I have the following:

kubectl auth can-i create taskrun --all-namespaces --as=system:serviceaccount:default:default

no

Ok, but where to go from here :-)

kubernetes

1 Answers

  1. Posting the answer as community wiki, feel free to edit and expand.

    As @mdaniel has already mentioned, there are no built-in tools in kubernetes which will figure out required access for a service account for you and then create a Role and RoleBinding.

    As a temporary solution it can be used a clusterrole - cluster-admin, however best practice is to provide only minimun possible and required access rights.

    Below are links to documentation which will be helpful:

    API request verb - API verbs like get, list, create, update, patch, watch, delete, and deletecollection are used for resource requests

    • 1