<p>Hi I saw <a href="https://itnext.io/running-kubectl-commands-from-within-a-pod-b303e8176088" rel="noreferrer">this documentation</a> where kubectl can run inside a pod in the default pod.
Is it possible to run kubectl inside a Job resource in a specified namespace?
Did not see any documentation or examples for the same.. </p>

<p>When I tried adding serviceAccounts to the container i got the error:</p>

<pre><code>Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:my-namespace:internal-kubectl" cannot list resource "pods" in API group "" in the namespace "my-namespace"
</code></pre>

<p>This was when i tried sshing into the container and running the kubctl.</p>

<p>Editing the question.....</p>

<p>As I mentioned earlier, based on the documentation I had added the service Accounts, Below is the yaml: </p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: internal-kubectl  
  namespace: my-namespace   
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: modify-pods
  namespace: my-namespace
rules:
  - apiGroups: [""]
    resources:
      - pods
    verbs:
      - get
      - list
      - delete      
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: modify-pods-to-sa
  namespace: my-namespace
subjects:
  - kind: ServiceAccount
    name: internal-kubectl
roleRef:
  kind: Role
  name: modify-pods
  apiGroup: rbac.authorization.k8s.io      
---
apiVersion: batch/v1
kind: Job
metadata:
  name: testing-stuff
  namespace: my-namespace
spec:
  template:
    metadata:
      name: testing-stuff
    spec:
      serviceAccountName: internal-kubectl
      containers:
      - name: tester
        image: bitnami/kubectl
        command:
         - "bin/bash"
         - "-c"
         - "kubectl get pods"
      restartPolicy: Never 
</code></pre>

<p>On running the job, I get the error:</p>

<pre><code>Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:my-namespace:internal-kubectl" cannot list resource "pods" in API group "" in the namespace "my-namespace"
</code></pre>

<blockquote>
  <p>Is it possible to run kubectl inside a Job resource in a specified namespace? Did not see any documentation or examples for the same..</p>
</blockquote>

<p>A <strong><a href="https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/" rel="noreferrer">Job</a> creates one or more Pods</strong> and ensures that a specified number of them successfully terminate. It means the permission aspect is the same as in a normal pod, meaning that <strong>yes, it is possible to run kubectl inside a job resource.</strong></p>

<p><strong>TL;DR:</strong></p>

<ul>
<li>Your yaml file is <strong>correct</strong>, maybe there were something else in your cluster, I recommend deleting and recreating these resources and try again.</li>
<li>Also check the version of your Kubernetes installation and job image's kubectl version, if they are more than 1 minor-version apart, <a href="https://kubernetes.io/docs/setup/release/version-skew-policy/#kubectl" rel="noreferrer">you may have unexpected incompatibilities</a></li>
</ul>

<hr>

<p><strong>Security Considerations:</strong></p>

<ul>
<li>Your job role's scope is the best practice according to <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions" rel="noreferrer">documentation</a> (specific role, to specific user on specific namespace).</li>
<li>If you use a <code>ClusterRoleBinding</code> with the <code>cluster-admin</code> role it will work, but it's over permissioned, and not recommended since it's giving full admin control over the entire cluster.</li>
</ul>

<hr>

<p><strong>Test Environment:</strong></p>

<ul>
<li>I deployed your config on a kubernetes 1.17.3 and run the job with <code>bitnami/kubectl</code> and  <code>bitnami/kubectl:1:17.3</code>. It worked on both cases.</li>
<li>In order to avoid incompatibility, use the <code>kubectl</code> with matching version with your server.</li>
</ul>

<hr>

<p><strong>Reproduction:</strong></p>

<pre><code>$ cat job-kubectl.yaml 
apiVersion: batch/v1
kind: Job
metadata:
  name: testing-stuff
  namespace: my-namespace
spec:
  template:
    metadata:
      name: testing-stuff
    spec:
      serviceAccountName: internal-kubectl
      containers:
      - name: tester
        image: bitnami/kubectl:1.17.3
        command:
         - "bin/bash"
         - "-c"
         - "kubectl get pods -n my-namespace"
      restartPolicy: Never 

$ cat job-svc-account.yaml 
apiVersion: v1
kind: ServiceAccount
metadata:
  name: internal-kubectl  
  namespace: my-namespace   
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: modify-pods
  namespace: my-namespace
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "delete"]      
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: modify-pods-to-sa
  namespace: my-namespace
subjects:
  - kind: ServiceAccount
    name: internal-kubectl
roleRef:
  kind: Role
  name: modify-pods
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<ul>
<li>I created two pods just to add output to the log of <code>get pods</code>.</li>
</ul>

<pre><code>$ kubectl run curl --image=radial/busyboxplus:curl -i --tty --namespace my-namespace
the pod is running
$ kubectl run ubuntu --generator=run-pod/v1 --image=ubuntu -n my-namespace
pod/ubuntu created
</code></pre>

<ul>
<li>Then I apply the <code>job</code>, <code>ServiceAccount</code>, <code>Role</code> and <code>RoleBinding</code></li>
</ul>

<pre><code>$ kubectl get pods -n my-namespace
NAME                    READY   STATUS      RESTARTS   AGE
curl-69c656fd45-l5x2s   1/1     Running     1          88s
testing-stuff-ddpvf     0/1     Completed   0          13s
ubuntu                  0/1     Completed   3          63s
</code></pre>

<ul>
<li>Now let's check the testing-stuff pod log to see if it logged the command output:</li>
</ul>

<pre><code>$ kubectl logs testing-stuff-ddpvf -n my-namespace
NAME                    READY   STATUS    RESTARTS   AGE
curl-69c656fd45-l5x2s   1/1     Running   1          76s
testing-stuff-ddpvf     1/1     Running   0          1s
ubuntu                  1/1     Running   3          51s
</code></pre>

<p>As you can see, it has succeeded running the job with the custom <code>ServiceAccount</code>.</p>

<p>Let me know if you have further questions about this case.</p>
