Kubernetes log, User "system:serviceaccount:default:default" cannot get services in the namespace

Question

Forbidden!Configured service account doesn't have access. Service account may have been revoked. User "system:serviceaccount:default:default" cannot get services in the namespace "mycomp-services-process"

For the above issue I have created "mycomp-service-process" namespace and checked the issue.

But it shows again message like this:

Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. User "system:serviceaccount:mycomp-services-process:default" cannot get services in the namespace "mycomp-services-process"

Answer 1

Creating a namespace won't, of course, solve the issue, as that is not the problem at all.

In the first error the issue is that serviceaccount default in default namespace can not get services because it does not have access to list/get services. So what you need to do is assign a role to that user using clusterrolebinding.

Following the set of minimum privileges, you can first create a role which has access to list services:

kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata:   namespace: default   name: service-reader rules: - apiGroups: [""] # "" indicates the core API group   resources: ["services"]   verbs: ["get", "watch", "list"] 

What above snippet does is create a clusterrole which can list, get and watch services. (You will have to create a yaml file and apply above specs)

Now we can use this clusterrole to create a clusterrolebinding:

kubectl create clusterrolebinding service-reader-pod \   --clusterrole=service-reader  \   --serviceaccount=default:default 

In above command the service-reader-pod is name of clusterrolebinding and it is assigning the service-reader clusterrole to default serviceaccount in default namespace. Similar steps can be followed for the second error you are facing.

In this case I created clusterrole and clusterrolebinding but you might want to create a role and rolebinding instead. You can check the documentation in detail here