k8s.Autorest.HttpOperationException: Operation returned an invalid status code 'Forbidden'

[dmachine7]

Hi folks,

I have a container hosted as pod inside a cluster.
I want to use config maps and secrets from "xyz" namespace in cluster.

I am trying to get cluster config like this.
var k8sConfig = KubernetesClientConfiguration.InClusterConfig();

But getting exception
k8s.Autorest.HttpOperationException: Operation returned an invalid status code 'Forbidden'

Am I doing it incorrectly or is this some bug?
Please guide me to a solution or workaround to this.

Thank you.

[dmachine7]

Please note: I am using token login from web UI for cluster dashboard

[brendandburns]

Chances are that the default service account for your pod doesn't have the right RBAC permissions.

InClusterConfig() uses the default pod service account

You can read more details about service accounts here:

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

[tg123]

To add, you can debug the permission with kubectl auth can-i

[homeahmed2012]

Is there any method that do the same can-i functionality from the code?

[IvanJosipovic]

See here, https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access

var model = new V1SelfSubjectAccessReview()
{
    ApiVersion = V1SelfSubjectAccessReview.KubeGroup + "/" + V1SelfSubjectAccessReview.KubeApiVersion,
    Kind = V1SelfSubjectAccessReview.KubeKind,
    Spec = new()
    {
        ResourceAttributes = new()
        {
            Group = "apps",
            NamespaceProperty = "namespace",
            Resource = "deployments",
            Verb = "delete"
        }
    }
};

var resp = await Client.CreateSelfSubjectAccessReviewAsync(model);

[Psynosaur]

In addition to changing the serviceAccountName to use the non default service account we also had to add automountServiceAccountToken: true to the pods template definition in the deployment yaml file.

This was for an AWS EKS cluster

[davidbrowning]

Running into a similar issue but specifically with Ingress objects. We have included the automountServiceAccountToken: true and also verified that kubectl auth can-i returns the expected "yes".

The only other resource we've found appears to be empty.

https://discuss.kubernetes.io/t/kubernetes-client-gives-forebidden-error-when-tried-to-read-the-ingress-list-body/17837