<p>I am trying to perform some operations on my AKS cluster using a C# worker service that is using the <a href="https://github.com/kubernetes-client/csharp" rel="nofollow noreferrer">kubernetes client library</a>. Currently my service is running on a single pod in the cluster. When I try to perform the <code>CreateSecret</code> operation , I get a <strong>403 exception</strong>.</p>
<p>I tried getting a bearer token and used that to set the KubeConfig's AccessToken but that also does not work.</p>
<p>I am wondering if there is a way I can access the kubeconfig from my pod (which I guess is only available on the master node?) or is there a different location of config which I can point to?</p>

<p>I would suggest to use service account instead of <code>kubeconfg</code> since you are running the application inside the cluster as pod.</p>
<pre><code>var config = KubernetesClientConfiguration.InClusterConfig()
</code></pre>
<p>Above code will use the <code>default</code> service account in the namespace where the pod is deployed. You will get a <code>Forbidden</code> error and to solve that you need to define <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> to provide authorization to the service account. Below is the <code>Role</code> and <code>RoleBinding</code> assuming you are using <code>default</code> namespace for deploying the pod.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: secret-creator
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  verbs: [&quot;create&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: secret-creator
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
</code></pre>
