<p>Greetings fellow tinkerers !</p>

<p><strong>What is my issue ?</strong></p>

<p>In a nutshell, user <em>toto</em> can't "get" a cronjob, even though the permissions seem fine.
More precisely:</p>

<pre><code>$&gt; kubectl get cronjob/test -n my_namespace
Error from server (Forbidden): cronjobs.batch "test" is forbidden: User "toto" cannot get resource "cronjobs" in API group "batch" in the namespace "my_namespace"
$&gt; kubectl auth can-i get cronjob/test -n my_namespace
no
</code></pre>

<p>even tough:</p>

<pre><code>$&gt; kubectl auth can-i get cronjobs -n my_namespace
yes
$&gt; kubectl auth can-i --list -n my_namespace
Resources      Non-Resource URLs  Resource Names   Verbs
...
cronjobs.batch []                 []               [get list watch list watch get]
...
$&gt; kubectl get cronjobs -n my_namespace
NAME     SCHEDULE     ...   AGE
test     */5 * * * *        2d21h
</code></pre>

<p>Please also note that the command works fine when executed by an admin-level user (from group system:masters), or if I add <em>toto</em> to the group system:masters.</p>

<p><strong>What have I tried ?</strong></p>

<p>I added full-permissions to all resources in all namespaces, to a group <em>toto</em> belongs to (let's call it <em>my_group</em>). The fact that it didn't work even then makes me think that my issue might not be caused by permissions but by another k8s mechanism.</p>

<p><strong>Additional informations</strong></p>

<p>As requested here are some additional informations:</p>

<pre><code>$&gt; kubectl version
Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T23:41:55Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"14+", GitVersion:"v1.14.9-eks-c0eccc", GitCommit:"c0eccca51d7500bb03b2f163dd8d534ffeb2f7a2", GitTreeState:"clean", BuildDate:"2019-12-22T23:14:11Z", GoVersion:"go1.12.12", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>The cluster is hosted on AWS using the EKS service, therefore:</p>

<ul>
<li>contexts have users dynamically authenticated using the <code>aws-iam-authenticator</code> binary</li>
<li>as the EKS doc mentions, we add users to groups in the <code>aws-auth</code> ConfigMap</li>
<li>then we define some clusterroles + rolebindings, targeting those aforementioned groups.</li>
</ul>

<p>Which for those 2 latter points, translates to the following yaml files:</p>

<pre><code>---
apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  ...
  mapUsers: |
    ...
    - userarn: arn:aws:iam::xxxxxxxxxxxx:user/toto
      username: toto
      groups:
        - system:basic-user
        - my_group
    ...

</code></pre>

<pre><code>---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: my_role
rules:
  ...
  - apiGroups: ["batch"]
    resources: ["cronjobs"]
    resourceNames: [""]
    verbs: ["list", "watch", "get"]
  ...
</code></pre>

<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my_rolebinding
  namespace: my_namespace
subjects:
  - kind: Group
    name: my_group
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: my_role
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>If I'm not mistaken, the API group is <code>batch</code> and resource is <code>cronjobs</code> not <code>cronjobs.batch</code>.</p>

<p>Kubernetes <a href="https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml" rel="nofollow noreferrer">cluster-roles.yaml</a> and docs for Kubernetes API <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#cronjob-v1beta1-batch" rel="nofollow noreferrer">cronjob</a>.</p>

<p><code>yaml</code> role should look like the following:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: my_namespace
  name: toto
rules:
- apiGroups: ["", "batch"]
  resources: ["cronjobs"]
  verbs: ["get", "list", "watch", "list", "watch"]
</code></pre>
