<p>I am trying to issue letsencrypt cerficicates for a kubernetes cluster deployments using a solution inspired from <a href="https://hub.docker.com/r/sjenning/kube-nginx-letsencrypt/" rel="nofollow noreferrer">here</a>.</p>

<p>Ultimately I execute the following curl statement from a pod to update a cluster resource: </p>

<p><code>curl -v --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -k -v -XPATCH  -H "Accept: application/json, */*" -H "Content-Type: application/strategic-merge-patch+json" -d @secret-patch.yml https://kubernetes/api/v1/namespaces/${NAMESPACE}/secrets/${SECRET}</code></p>

<p>To get the following error:</p>

<p><code>"message": "secrets \"converse-hr\" is forbidden: User \"system:serviceaccount:default:letsencrypt\" cannot patch secrets in the namespace \"default\": Unknown user \"system:serviceaccount:default:letsencrypt\"",
</code></p>

<p>I have followed the instructions in these tickets<a href="https://github.com/fabric8io/fabric8/issues/6840" rel="nofollow noreferrer"> [1</a>,<a href="https://stackoverflow.com/questions/49027234/k8s-gce1-8-7-pods-is-forbidden-unknown-user-systemserviceaccountdefaultde">2</a>,<a href="https://github.com/cvallance/mongo-k8s-sidecar/issues/75" rel="nofollow noreferrer">3]</a>.</p>

<p>And I have the following configuration and output:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: letsencrypt-service-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app: letsencrypt-service-dev
  template:
    metadata:
      labels:
        app: letsencrypt-service-dev
    spec:
      serviceAccountName: letsencrypt
      containers:
      - name: letsencrypt-service-dev
        image: &lt;image-name&gt;
        ports:
        - name: letsencrypt
          containerPort: 3300
        imagePullPolicy: Always
        env:
          - name: DOMAINS
            value: &lt;domain&gt;
          - name: EMAIL
            value: &lt;email&gt;
          - name: SECRET
            value: &lt;secret-name&gt;
          - name: DEPLOYMENT
            value: &lt;deployment&gt;
---

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: letsencrypt

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: patch-tls
  namespace: default
subjects:
- kind: Group
  name: system:serviceaccount:default:letsencrypt # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole #this must be Role or ClusterRole
  name: cluster-admin # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Here is the output of relevant kubectl commands</p>

<pre><code>kubectl describe serviceaccount letsencrypt
Name:         letsencrypt
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{},"name":"letsencrypt","namespace":"default"}}

Image pull secrets:  gcr-base-registry-json-key
Mountable secrets:   letsencrypt-token-xdp7w
Tokens:              letsencrypt-token-xdp7w
Events:              &lt;none&gt;
</code></pre>

<hr>

<pre><code>kubectl describe clusterrolebinding patch-tls
Name:         patch-tls
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"patch-tls","namespace":""},"roleRef":{"ap...
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name                                       Namespace
  ----   ----                                       ---------
  Group  system:serviceaccount:default:letsencrypt
</code></pre>

<hr>

<pre><code>kubectl describe pod letsencrypt-service-dev-7f989dddc4-bxkss
Name:           letsencrypt-service-dev-7f989dddc4-bxkss
Namespace:      default
Node:           &lt;node-name&gt;
Start Time:     Thu, 30 Aug 2018 10:03:58 +0200
Labels:         app=letsencrypt-service-dev
                pod-template-hash=3954588870
Annotations:    kubernetes.io/limit-ranger=LimitRanger plugin set: cpu request for container letsencrypt-service-dev
Status:         Running
IP:             10.32.2.21
Controlled By:  ReplicaSet/letsencrypt-service-dev-7f989dddc4
Containers:
  letsencrypt-service-dev:
    Container ID:   docker://e6cd039cae94b564d3a2d5cf2768f363abe558118010c439772823f16c9a9a32
    Image:          &lt;image-name&gt;
    Image ID:       &lt;image-id&gt;
    Port:           3300/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Thu, 30 Aug 2018 10:04:00 +0200
    Ready:          True
    Restart Count:  0
    Requests:
      cpu:  100m
    Environment:
      DOMAINS:     &lt;domain&gt;
      EMAIL:       &lt;email&gt;
      SECRET:      &lt;secret&gt;
      DEPLOYMENT:  &lt;deployment&gt;
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from letsencrypt-token-xdp7w (ro)
Conditions:
  Type           Status
  Initialized    True 
  Ready          True 
  PodScheduled   True 
Volumes:
  letsencrypt-token-xdp7w:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  letsencrypt-token-xdp7w
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  &lt;none&gt;
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:          &lt;none&gt;
</code></pre>

<hr>

<pre><code>kubectl version                                              
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.2", GitCommit:"bb9ffb1654d4a729bb4cec18ff088eacc153c239", GitTreeState:"clean", BuildDate:"2018-08-08T16:31:10Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"9+", GitVersion:"v1.9.7-gke.5", GitCommit:"9b635efce81582e1da13b35a7aa539c0ccb32987", GitTreeState:"clean", BuildDate:"2018-08-02T23:42:40Z", GoVersion:"go1.9.3b4", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<hr>

<p><strong>Working set of resources based on the answers below:</strong></p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: letsencrypt
</code></pre>

<hr>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: patch-tls
  namespace: default
subjects:
- kind: ServiceAccount
  name: letsencrypt # Name is case sensitive
  namespace: default
roleRef:
  kind: ClusterRole #this must be Role or ClusterRole
  name: cluster-admin # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<hr>

<pre><code>kubectl describe pod letsencrypt-service-dev-7f989dddc4-bxkss
    Name:           letsencrypt-service-dev-7f989dddc4-bxkss
    Namespace:      default
    Node:           &lt;node-name&gt;
    Start Time:     Thu, 30 Aug 2018 10:03:58 +0200
    Labels:         app=letsencrypt-service-dev
                    pod-template-hash=3954588870
    Annotations:    kubernetes.io/limit-ranger=LimitRanger plugin set: cpu request for container letsencrypt-service-dev
    Status:         Running
    IP:             10.32.2.21
    Controlled By:  ReplicaSet/letsencrypt-service-dev-7f989dddc4
    Containers:
      letsencrypt-service-dev:
        Container ID:   docker://e6cd039cae94b564d3a2d5cf2768f363abe558118010c439772823f16c9a9a32
        Image:          &lt;image-name&gt;
        Image ID:       &lt;image-id&gt;
        Port:           3300/TCP
        Host Port:      0/TCP
        State:          Running
          Started:      Thu, 30 Aug 2018 10:04:00 +0200
        Ready:          True
        Restart Count:  0
        Requests:
          cpu:  100m
        Environment:
          DOMAINS:     &lt;domain&gt;
          EMAIL:       &lt;email&gt;
          SECRET:      &lt;secret&gt;
          DEPLOYMENT:  &lt;deployment&gt;
        Mounts:
          /var/run/secrets/kubernetes.io/serviceaccount from letsencrypt-token-xdp7w (ro)
    Conditions:
      Type           Status
      Initialized    True 
      Ready          True 
      PodScheduled   True 
    Volumes:
      letsencrypt-token-xdp7w:
        Type:        Secret (a volume populated by a Secret)
        SecretName:  letsencrypt-token-xdp7w
        Optional:    false
    QoS Class:       Burstable
    Node-Selectors:  &lt;none&gt;
    Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                     node.kubernetes.io/unreachable:NoExecute for 300s
    Events:          &lt;none&gt;
</code></pre>

Vasil K
<p>I suppose serviceaccount can't be configured as group, try the following:</p>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: patch-tls
subjects:
- kind: ServiceAccount
  name: letsencrypt
  namespace: default
roleRef:
  kind: ClusterRole 
  name: cluster-admin 
  apiGroup: rbac.authorization.k8s.io
</code></pre>
