skip to Main Content

I want a deployment in kubernetes to have the permission to restart itself, from within the cluster.

I know I can create a serviceaccount and bind it to the pod, but I’m missing the name of the most specific permission (i.e. not just allowing '*') to allow for the command

kubectl rollout restart deploy <deployment>

here’s what I have, and ??? is what I’m missing

apiVersion: v1
kind: ServiceAccount
metadata:
  name: restart-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: restarter
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["list", "???"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: testrolebinding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: restart-sa
    namespace: default
roleRef:
  kind: Role
  name: restarter
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
  - image: nginx
    name: nginx
  serviceAccountName: restart-sa

2

Answers


  1. I believe the following is the minimum permissions required to restart a deployment:

    rules:
     - apiGroups: ["apps", "extensions"]
       resources: ["deployments"]
       resourceNames: [$DEPLOYMENT]
       verbs: ["get", "patch"]
    
    Login or Signup to reply.
  2. If you want permission to restart kubernetes deployment itself from within the cluster you need to set permission on rbac authorisation.

    In the yaml file you have missed some specific permissions under Role:rules you need to add in the below format
    verbs: ["get", "watch", "list"]

    Instead of “Pod” you need to add “deployment” in the yaml file.

    Make sure that you add “serviceAccountName: restart-sa” in the deployment yaml file under “spec:containers.” As mentioned below:

    apiVersion: apps/v1  
    kind: Deployment
    metadata:
      name: nginx-deployment
      labels:
        app: nginx
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: nginx
      template:
        metadata:
          labels:
            app: nginx
        spec:
          containers:
          - name: nginx
            image: nginx:1.14.2
            ports:
            - containerPort: 80
          serviceAccountName: restart-sa
    

    Then you can restart the deployment using the below command:

    $ kubectl rollout restart deployment [deployment_name]

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search