{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30924","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30924/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30924/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30924/events","html_url":"https://github.com/kubernetes/kubernetes/issues/30924","id":171998535,"number":30924,"title":"Feature Request: Allow RBAC Roles to have permissions in other namespaces","user":{"login":"micahhausler","id":791000,"avatar_url":"https://avatars.githubusercontent.com/u/791000?v=3","gravatar_id":"","url":"https://api.github.com/users/micahhausler","html_url":"https://github.com/micahhausler","followers_url":"https://api.github.com/users/micahhausler/followers","following_url":"https://api.github.com/users/micahhausler/following{/other_user}","gists_url":"https://api.github.com/users/micahhausler/gists{/gist_id}","starred_url":"https://api.github.com/users/micahhausler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/micahhausler/subscriptions","organizations_url":"https://api.github.com/users/micahhausler/orgs","repos_url":"https://api.github.com/users/micahhausler/repos","events_url":"https://api.github.com/users/micahhausler/events{/privacy}","received_events_url":"https://api.github.com/users/micahhausler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/auth","name":"area/auth","color":"00cc00"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubectl","name":"component/kubectl","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/ux","name":"team/ux","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-18T20:55:08Z","updated_at":"2016-08-18T21:34:38Z","closed_at":null,"body":"I have 2 namespaces, `[\"myapp\", \"default\"]`. I created a “myapp” deployment and a “myapp” service in the “myapp” namespace.  (I’m using RBAC and its awesome)\r\n\r\nI have Jenkins workers running in the “default” namespace, and I’d like to assign a `ServiceAccount` to Jenkins that has permissions to modify deployments in the \"myapp\" namespace\r\n\r\nHere’s my current `ServiceAccount`, `Role`, and `RoleBinding`.\r\n\r\n```yaml\r\napiVersion: v1\r\nkind: ServiceAccount\r\nmetadata:\r\n  name: jenkins-deployer\r\n  namespace: default\r\n---\r\nkind: Role\r\napiVersion: rbac.authorization.k8s.io/v1alpha1\r\nmetadata:\r\n  namespace: myapp\r\n  name: jenkins-deployer\r\nrules:\r\n- apiGroups: [\"extensions\"]\r\n  resources: [\"deployments\"]\r\n  verbs: [\"*\"]\r\n  nonResourceURLs: [\"/version\"]\r\n---\r\nkind: RoleBinding\r\napiVersion: rbac.authorization.k8s.io/v1alpha1\r\nmetadata:\r\n  name: deploy-myapp\r\n  namespace: default\r\nsubjects:\r\n- kind: ServiceAccount\r\n  name: jenkins-deployer\r\n  namespace: default\r\nroleRef:\r\n  kind: Role\r\n  namespace: myapp\r\n  name: jenkins-deployer\r\n  apiVersion: rbac.authorization.k8s.io/v1alpha1\r\n```\r\n\r\nWhen I try to use the secret on the \"jenkins-deployer” ServiceAccount to just get deployments in the “myapp” namespace, I get `Forbidden`\r\n\r\n\r\n**Kubernetes version** (use `kubectl version`):\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"3\", GitVersion:\"v1.3.4+dd6b458\", GitCommit:\"dd6b458ef8dbf24aff55795baa68f83383c9b3a9\", GitTreeState:\"not a git tree\", BuildDate:\"2016-08-04T09:44:57Z\", GoVersion:\"go1.6.3\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"3\", GitVersion:\"v1.3.5\", GitCommit:\"b0deb2eb8f4037421077f77cb163dbb4c0a2a9f5\", GitTreeState:\"clean\", BuildDate:\"2016-08-11T20:21:58Z\", GoVersion:\"go1.6.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n**Environment**:\r\n- **Cloud provider or hardware configuration**: AWS EC2\r\n- **OS** (e.g. from /etc/os-release):\r\n```\r\nNAME=CoreOS\r\nID=coreos\r\nVERSION=1068.9.0\r\nVERSION_ID=1068.9.0\r\nBUILD_ID=2016-08-05-0455\r\nPRETTY_NAME=\"CoreOS 1068.9.0 (MoreOS)\"\r\nANSI_COLOR=\"1;32\"\r\nHOME_URL=\"https://coreos.com/\"\r\nBUG_REPORT_URL=\"https://github.com/coreos/bugs/issues\"\r\n```\r\n- **Kernel** (e.g. `uname -a`): \r\n```\r\nLinux ip-172-31-34-166.us-west-2.compute.internal 4.6.3-coreos #2 SMP Fri Aug 5 04:51:16 UTC 2016 x86_64 Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz GenuineIntel GNU/Linux\r\n```\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\nrun `kubectl create -f` on this file\r\n\r\n```yaml\r\napiVersion: v1\r\nkind: Namespace\r\nmetadata:\r\n  name: myapp\r\n---\r\napiVersion: extensions/v1beta1\r\nkind: Deployment\r\nmetadata:\r\n  labels:\r\n    app: myapp\r\n  name: myapp\r\n  namespace: myapp\r\nspec:\r\n  replicas: 1\r\n  selector:\r\n    matchLabels:\r\n      app: myapp\r\n  template:\r\n    metadata:\r\n      labels:\r\n        app: myapp\r\n      name: myapp\r\n    spec:\r\n      containers:\r\n      - name: web\r\n        image: \"nginx:latest\"\r\n        ports:\r\n        - containerPort: 80\r\n          protocol: TCP\r\n---\r\napiVersion: v1\r\nkind: ServiceAccount\r\nmetadata:\r\n  name: jenkins-deployer\r\n  namespace: default\r\n---\r\nkind: Role\r\napiVersion: rbac.authorization.k8s.io/v1alpha1\r\nmetadata:\r\n  namespace: myapp\r\n  name: jenkins-deployer\r\nrules:\r\n- apiGroups: [\"extensions\"]\r\n  resources: [\"deployments\"]\r\n  verbs: [\"*\"]\r\n  nonResourceURLs: [\"/version\"]\r\n---\r\nkind: RoleBinding\r\napiVersion: rbac.authorization.k8s.io/v1alpha1\r\nmetadata:\r\n  name: deploy-myapp\r\n  namespace: default\r\nsubjects:\r\n- kind: ServiceAccount\r\n  name: jenkins-deployer\r\n  namespace: default\r\nroleRef:\r\n  kind: Role\r\n  namespace: myapp\r\n  name: jenkins-deployer\r\n  apiVersion: rbac.authorization.k8s.io/v1alpha1\r\n```\r\n\r\n**What happened**:\r\nTo test the above scenario, I ran\r\n```bash\r\nJENKINS_SECRET_NAME=$(kubectl get sa jenkins-deployer -o json  | jq -r .secrets[0].name)\r\nJENKINS_TOKEN=$(kubectl get secret ${JENKINS_SECRET_NAME} -o json |jq -r .data.token |base64 -D)\r\n\r\ncurl -H \"Authorization: Bearer $JENKINS_TOKEN\" \\\r\n    https://kubernetes.io/apis/extensions/v1beta1/namespaces/myapp/deployments/myapp \\\r\n    -vvv\r\n```\r\nand the reply was\r\n```\r\nForbidden: \"/apis/extensions/v1beta1/namespaces/myapp/deployments/myapp\"\r\n```\r\n\r\n**What you expected to happen**:\r\nI expected that my role could access the resource in the other namespace\r\n\r\n\r\n**Anything else do we need to know**:\r\nI understand that I could use a `ClusterRole`, but that would give permissions across _all_ namespaces, and that is not what I want. The `default` role in the default namespace, has permission to get anything in any namespace, and I'd just like to dial that down.\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/240864413","html_url":"https://github.com/kubernetes/kubernetes/issues/30924#issuecomment-240864413","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30924","id":240864413,"user":{"login":"derekwaynecarr","id":6233452,"avatar_url":"https://avatars.githubusercontent.com/u/6233452?v=3","gravatar_id":"","url":"https://api.github.com/users/derekwaynecarr","html_url":"https://github.com/derekwaynecarr","followers_url":"https://api.github.com/users/derekwaynecarr/followers","following_url":"https://api.github.com/users/derekwaynecarr/following{/other_user}","gists_url":"https://api.github.com/users/derekwaynecarr/gists{/gist_id}","starred_url":"https://api.github.com/users/derekwaynecarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekwaynecarr/subscriptions","organizations_url":"https://api.github.com/users/derekwaynecarr/orgs","repos_url":"https://api.github.com/users/derekwaynecarr/repos","events_url":"https://api.github.com/users/derekwaynecarr/events{/privacy}","received_events_url":"https://api.github.com/users/derekwaynecarr/received_events","type":"User","site_admin":false},"created_at":"2016-08-18T21:34:37Z","updated_at":"2016-08-18T21:34:37Z","body":"/cc @deads2k "}}
{"actor":{"display_login":"derekwaynecarr"}}