Is there a kubernetes role definition to allow the command `kubectl rollout restart deploy <deployment>`? - Nginx

yspreen
August 29, 2021
204 views
0 votes
2 Answers

I want a deployment in kubernetes to have the permission to restart itself, from within the cluster.

I know I can create a serviceaccount and bind it to the pod, but I’m missing the name of the most specific permission (i.e. not just allowing '*') to allow for the command

kubectl rollout restart deploy <deployment>

here’s what I have, and ??? is what I’m missing

apiVersion: v1
kind: ServiceAccount
metadata:
  name: restart-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: restarter
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["list", "???"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: testrolebinding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: restart-sa
    namespace: default
roleRef:
  kind: Role
  name: restarter
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
  - image: nginx
    name: nginx
  serviceAccountName: restart-sa

Answers

- GariSingh
- August 30, 2021 at 10:01 am
- 0 votes
0
I believe the following is the minimum permissions required to restart a deployment:
```
rules:
 - apiGroups: ["apps", "extensions"]
   resources: ["deployments"]
   resourceNames: [$DEPLOYMENT]
   verbs: ["get", "patch"]
```
Login or Signup to reply.

- BakulMitra
- August 30, 2021 at 11:36 am
- 0 votes
0
If you want permission to restart kubernetes deployment itself from within the cluster you need to set permission on rbac authorisation.

In the yaml file you have missed some specific permissions under Role:rules you need to add in the below format
verbs: ["get", "watch", "list"]

Instead of “Pod” you need to add “deployment” in the yaml file.

Make sure that you add “serviceAccountName: restart-sa” in the deployment yaml file under “spec:containers.” As mentioned below:
```
apiVersion: apps/v1  
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
      serviceAccountName: restart-sa
```
Then you can restart the deployment using the below command:

$ kubectl rollout restart deployment [deployment_name]
Login or Signup to reply.