Skip to content

Instantly share code, notes, and snippets.

@eranchetz
Last active November 20, 2018 16:25
Show Gist options
  • Save eranchetz/06ceaaee02771f86fa91e7dbfeb2a65d to your computer and use it in GitHub Desktop.
Save eranchetz/06ceaaee02771f86fa91e7dbfeb2a65d to your computer and use it in GitHub Desktop.
Cluster role binding that allows to get/list/watch pods in any namespace.
# Based on this documentation : https://kubernetes.io/docs/reference/access-authn-authz/rbac/
# Create a Service Account
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-service-account
# Create a role that allows API calls for get/list/watch on pods
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: my-role-pods
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get","list","watch"]
---
# Bind the ServiceAccount to The Role on all namesapces
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: my-cluster-role-binding
subjects:
- kind: ServiceAccount
name: my-service-account
roleRef:
kind: ClusterRole
name: my-role-pods
apiGroup: rbac.authorization.k8s.io
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment