<p>I have been working on creating a application which can perform verification test on the deployed istio components in the kube-cluster. The constraint in my case is that I have run this application as a pod inside the kubernetes and I cannot provide cluster-admin role to the pod of the application so that it can do all the operations. I have to create a restricted <code>ClusterRole</code> just to provide enough access so that application list and get all the required deployed istio resources (Reason for creating a cluster role is because when istio is deployed it created both namespace level and cluster level resources). Currently my application won't run at all if I use my restricted <code>ClusterRole</code> and outputs and error</p>
<pre><code>Error: failed to fetch istiod pod, error: pods is forbidden: User &quot;system:serviceaccount:istio-system:istio-deployment-verification-sa&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;istio-system&quot;
</code></pre>
<p>Above error doesn't make sense as I have explicitly mentioned the core api group in my <code>ClusterRole</code> and also mentioned pods as a resource in the <code>resourceType</code> child of my <code>ClusterRole</code> definition.</p>
<p><strong>Clusterrole.yaml</strong></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Values.clusterrole.name }}
  namespace: {{ .Values.clusterrole.clusterrolens}}
rules:
- apiGroups:
  - &quot;rbac.authorization.k8s.io&quot;
  - &quot;&quot; #enabling access to core API
  - &quot;networking.istio.io&quot;
  - &quot;install.istio.io&quot;
  - &quot;autoscaling&quot;
  - &quot;apps&quot;
  - &quot;admissionregistration.k8s.io&quot;
  - &quot;policy&quot;
  - &quot;apiextensions.k8s.io&quot;
  resources:
  - &quot;clusterroles&quot;
  - &quot;clusterolebindings&quot;
  - &quot;serviceaccounts&quot;
  - &quot;roles&quot;
  - &quot;rolebindings&quot;
  - &quot;horizontalpodautoscalers&quot;
  - &quot;configmaps&quot;
  - &quot;deployments&quot;
  - &quot;mutatingwebhookconfigurations&quot;
  - &quot;poddisruptionbudgets&quot;
  - &quot;envoyfilters&quot;
  - &quot;validatingwebhookconfigurations&quot;
  - &quot;pods&quot;
  - &quot;wasmplugins&quot;
  - &quot;destinationrules&quot;
  - &quot;envoyfilters&quot;
  - &quot;gateways&quot;
  - &quot;serviceentries&quot;
  - &quot;sidecars&quot;
  - &quot;virtualservices&quot;
  - &quot;workloadentries&quot;
  - &quot;workloadgroups&quot;
  - &quot;authorizationpolicies&quot;
  - &quot;peerauthentications&quot;
  - &quot;requestauthentications&quot;
  - &quot;telemetries&quot;
  - &quot;istiooperators&quot;
  resourceNames:
  - &quot;istiod-istio-system&quot;
  - &quot;istio-reader-istio-system&quot;
  - &quot;istio-reader-service-account&quot;
  - &quot;istiod-service-account&quot;
  - &quot;wasmplugins.extensions.istio.io&quot;
  - &quot;destinationrules.networking.istio.io&quot;
  - &quot;envoyfilters.networking.istio.io&quot;
  - &quot;gateways.networking.istio.io&quot;
  - &quot;serviceentries.networking.istio.io&quot;
  - &quot;sidecars.networking.istio.io&quot;
  - &quot;virtualservices.networking.istio.io&quot;
  - &quot;workloadentries.networking.istio.io&quot;
  - &quot;workloadgroups.networking.istio.io&quot;
  - &quot;authorizationpolicies.security.istio.io&quot;
  - &quot;peerauthentications.security.istio.io&quot;
  - &quot;requestauthentications.security.istio.io&quot;
  - &quot;telemetries.telemetry.istio.io&quot;
  - &quot;istiooperators.install.istio.io&quot;
  - &quot;istiod&quot;
  - &quot;istiod-clusterrole-istio-system&quot;
  - &quot;istiod-gateway-controller-istio-system&quot;
  - &quot;istiod-clusterrole-istio-system&quot;
  - &quot;istiod-gateway-controller-istio-system&quot;
  - &quot;istio&quot;
  - &quot;istio-sidecar-injector&quot;
  - &quot;istio-reader-clusterrole-istio-system&quot;
  - &quot;stats-filter-1.10&quot;
  - &quot;tcp-stats-filter-1.10&quot;
  - &quot;stats-filter-1.11&quot;
  - &quot;tcp-stats-filter-1.11&quot;
  - &quot;stats-filter-1.12&quot;
  - &quot;tcp-stats-filter-1.12&quot;
  - &quot;istio-validator-istio-system&quot;
  - &quot;istio-ingressgateway-microservices&quot;
  - &quot;istio-ingressgateway-microservices-sds&quot;
  - &quot;istio-ingressgateway-microservices-service-account&quot;
  - &quot;istio-ingressgateway-public&quot;
  - &quot;istio-ingressgateway-public-sds&quot;
  - &quot;istio-ingressgateway-public-service-account&quot;
  verbs:
  - get
  - list
</code></pre>
<p>Application I have built leverage the <code>istioctl</code> docker container published by istio on dockerhub. <a href="https://hub.docker.com/r/istio/istioctl/tags" rel="nofollow noreferrer">Link</a>.</p>
<p>I want to understand what changes are required in above <code>ClusterRole</code> definition so that I can perform the get and list operations for the pods in the namespace.</p>
<p>I would also want to understand that is it possible that the error I am getting is trying to reference some other resource in the cluster?</p>
<p>Cluster information:</p>
<pre><code>Kubernetes version: 1.20
Istioctl docker image version: 1.12.2
Istio version: 1.12.1
</code></pre>

<p>As OP mentioned in the comment problem is resolved after my suggestion:</p>
<blockquote>
<p>Please run the command <code>kubectl auth can-i list pods --namespace istio-system --as system:serviceaccount:istio-system:istio-deployment-verification-sa</code> and attach result to the question. Look also <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">here</a></p>
</blockquote>
<p>OP has confirmed that problem is resolved:</p>
<blockquote>
<p>thanx for the above command using above I was finally able to nail down the issue and found the issue to be with first resourceName and second we need to mention core api in the api group before any other. Thank you issue is resolved now.</p>
</blockquote>
