<p>I am following this helm + secure - guide:</p>
<p><a href="https://www.cockroachlabs.com/docs/stable/orchestrate-cockroachdb-with-kubernetes.html#helm" rel="nofollow noreferrer">https://www.cockroachlabs.com/docs/stable/orchestrate-cockroachdb-with-kubernetes.html#helm</a></p>
<p>I deployed the cluster with this command: <code>$ helm install my-release --values my-values.yaml cockroachdb/cockroachdb --namespace=thesis-crdb</code></p>
<p>This is how it looks: <code>$ helm list --namespace=thesis-crdb</code></p>
<pre><code>NAME            NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                                      APP VERSION
my-release      thesis-crdb     1               2021-01-31 17:38:52.8102378 +0100 CET   deployed        cockroachdb-5.0.4                          20.2.4
</code></pre>
<p>Here is how it looks using: <code>$ kubectl get all --namespace=thesis-crdb</code></p>
<pre><code>NAME                                    READY   STATUS      RESTARTS   AGE
pod/my-release-cockroachdb-0            1/1     Running     0          7m35s
pod/my-release-cockroachdb-1            1/1     Running     0          7m35s
pod/my-release-cockroachdb-2            1/1     Running     0          7m35s
pod/my-release-cockroachdb-init-fhzdn   0/1     Completed   0          7m35s

NAME                                    TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)              AGE
service/my-release-cockroachdb          ClusterIP   None         &lt;none&gt;        26257/TCP,8080/TCP   7m35s
service/my-release-cockroachdb-public   ClusterIP   10.xx.xx.x   &lt;none&gt;        26257/TCP,8080/TCP   7m35s

NAME                                      READY   AGE
statefulset.apps/my-release-cockroachdb   3/3     7m35s

NAME                                    COMPLETIONS   DURATION   AGE
job.batch/my-release-cockroachdb-init   1/1           43s        7m36s
</code></pre>
<p>In the <code>my-values.yaml</code>-file I only changed the tls from <code>false</code> to <code>true</code>:</p>
<pre><code>tls:
  enabled: true
</code></pre>
<p>So far so good, but from here on the guide isn't really working for me anymore. I try as they say with getting the csr: <code>kubectl get csr --namespace=thesis-crdb</code></p>
<pre><code>No resources found
</code></pre>
<p>Ok, perhaps not needed. I carry on to deploy the <code>client-secure</code>
I download the file: <a href="https://raw.githubusercontent.com/cockroachdb/cockroach/master/cloud/kubernetes/client-secure.yaml" rel="nofollow noreferrer">https://raw.githubusercontent.com/cockroachdb/cockroach/master/cloud/kubernetes/client-secure.yaml</a></p>
<p>And changes the <code>serviceAccountName: cockroachdb</code> to <code>serviceAccountName: my-release-cockroachdb</code>.</p>
<p>I try to deploy it with <code>$ kubectl create -f client-secure.yaml --namespace=thesis-crdb</code> but it throws this error:</p>
<pre><code>Error from server (Forbidden): error when creating &quot;client-secure.yaml&quot;: pods &quot;cockroachdb-client-secure&quot; is forbidden: error looking up service account thesis-crdb/my-release-cockroachdb: serviceaccount &quot;my-release-cockroachdb&quot; not found
</code></pre>
<p>Anyone got an idea how to solve this? I'm fairly sure it's something with the namespace that is messing it up.</p>
<p>I have tried to put the namespace in the metadata-section</p>
<pre><code>metadata:
  namespace: thesis-crdb
</code></pre>
<p>And then try to deploy it with: <code>kubectl create -f client-secure.yaml</code> but to no avail:</p>
<pre><code>Error from server (Forbidden): error when creating &quot;client-secure.yaml&quot;: pods &quot;cockroachdb-client-secure&quot; is forbidden: error looking up service account thesis-crdb/my-release-cockroachdb: serviceaccount &quot;my-release-cockroachdb&quot; not found
</code></pre>

<p>You mention in question that you have changed <code>serviceAccountName</code> in YAML.</p>
<blockquote>
<p>And changes the <code>serviceAccountName: cockroachdb</code> to <code>serviceAccountName: my-release-cockroachdb</code>.</p>
</blockquote>
<p>So Root Cause of your issue is related with <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">ServiceAccount</a> misconfiguration.</p>
<h3>Background</h3>
<p>In your cluster you have something called <code>ServiceAccount</code>.</p>
<blockquote>
<p>When you (a human) access the cluster (for example, using kubectl), you are authenticated by the apiserver as a particular User Account (currently this is usually admin, unless your cluster administrator has customized your cluster). Processes in containers inside pods can also contact the apiserver. When they do, they are authenticated as a particular Service Account (for example, default).</p>
</blockquote>
<p>To <code>ServiceAccount</code> you also should configure <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> which grants you permissions to create resources.</p>
<blockquote>
<p>Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.</p>
<p>RBAC authorization uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API.</p>
</blockquote>
<p>If you don't have proper <code>RBAC</code> permissions you will not be able to create resources.</p>
<p>In Kubernetes you can find <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">Role and ClusterRole</a>. <code>Role</code> sets permissions within a particular namespace and <code>ClusterRole</code> sets permissions in whole cluster.
Besides that, you also need to bind roles using <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">RoleBinding and ClusterRoleBinding</a>.</p>
<p>In addition, if you would use Cloud environment, you would also need special rights in project. Your guide provides instructions to do it <a href="https://www.cockroachlabs.com/docs/stable/orchestrate-cockroachdb-with-kubernetes.html#hosted-gke" rel="nofollow noreferrer">here</a>.</p>
<h3>Root cause</h3>
<p>I've checked <a href="https://github.com/cockroachdb/cockroach" rel="nofollow noreferrer">cockroachdb chart</a> and it creates <code>ServiceAccount</code>, <code>Role</code>, <code>ClusterRole</code>, <code>RoleBinding</code> and <code>ClusterRoleBinding</code> for <code>cockroachdb</code> and <code>prometheus</code>. There is no configuration for <code>my-release-cockroachdb</code>.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cockroachdb
...
  verbs:
  - create
  - get
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cockroachdb
  labels:
    app: cockroachdb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cockroachdb
...
</code></pre>
<p>In <code>client-secure.yaml</code> you change <code>serviceAccountName</code> to <code>my-release-cockroachdb</code> and Kubernetes cannot find that <code>ServiceAccount</code> as it was not created by <code>cluster administrator</code> or <code>cockroachdb chart</code>.</p>
<p>To list <code>ServiceAccounts</code> in default <code>namespace</code> you can use command <code>$ kubectl get ServiceAccount</code>, however if you would check all <code>ServiceAccounts</code> in cluster you should add <code>-A</code> to your command - <code>$ kubectl get ServiceAccount -A</code>.</p>
<h3>Solution</h3>
<p><strong>Option 1</strong> is to use existing <code>ServiceAccount</code> with proper permissions like <code>SA</code> created by <code>cockroachdb chart</code> which is <code>cockroachdb</code>, not <code>my-release-cockroachdb</code>.</p>
<p><strong>Option 2</strong> is to create <code>ServiceAccount</code>, <code>Role/ClusterRole</code> and <code>RoleBinding/ClusterRoleBinding</code> for <code>my-release-cockroachdb</code>.</p>
