<p>I want to configure native Kubernetes cluster using Terraform script. I tried this Terraform script:</p>
<pre><code>terraform {
  required_providers {
    kubernetes = {
      source = &quot;hashicorp/kubernetes&quot;
      version = &quot;2.13.1&quot;
    }
    kubectl = {
      source = &quot;gavinbunney/kubectl&quot;
      version = &quot;1.14.0&quot;
    }
    helm = {
      source = &quot;hashicorp/helm&quot;
      version = &quot;2.6.0&quot;
    }
  }
}

provider &quot;kubectl&quot; {
  # run kubectl cluster-info to get expoint and port
  host = &quot;https://192.168.1.139:6443/&quot;
  token = &quot;eyJhbGciOiJSUzI1NiIsImt.....&quot;
  insecure = &quot;true&quot;
}

provider &quot;kubernetes&quot; {
  # run kubectl cluster-info to get expoint and port
  host = &quot;https://192.168.1.139:6443/&quot;
  token = &quot;eyJhbGciOiJSUzI1NiIsImt.....&quot;
  insecure = &quot;true&quot;
}

resource &quot;kubernetes_namespace&quot; &quot;example&quot; {
  metadata {
    annotations = {
      name = &quot;example-annotation&quot;
    }

    labels = {
      mylabel = &quot;label-value&quot;
    }

    name = &quot;terraform-example-namespace&quot;
  }
}
</code></pre>
<p>ref: <a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs" rel="nofollow noreferrer">https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs</a>
<a href="https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs" rel="nofollow noreferrer">https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs</a></p>
<p>I tried to create a user from this tutorial: <a href="https://killercoda.com/kimwuestkamp/scenario/k8s1.24-serviceaccount-secret-changes" rel="nofollow noreferrer">https://killercoda.com/kimwuestkamp/scenario/k8s1.24-serviceaccount-secret-changes</a></p>
<pre><code>kubectl create sa cicd

kubectl get sa,secret


cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: cicd
spec:
  serviceAccount: cicd
  containers:
  - image: nginx
    name: cicd
EOF




kubectl exec cicd -- cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo

kubectl exec cicd cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo


kubectl create token cicd

kubectl create token cicd --duration=999999h



cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: cicd
  annotations:
    kubernetes.io/service-account.name: &quot;cicd&quot;
EOF



kubectl get sa,secret

kubectl describe secret cicd

kubectl describe sa cicd

kubectl get sa cicd -oyaml

kubectl get sa,secret
</code></pre>
<p>When I run the Terraform script I get error:</p>
<pre><code>kubernetes_namespace.example: Creating...
╷
│ Error: namespaces is forbidden: User &quot;system:serviceaccount:default:cicd&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope
│
│   with kubernetes_namespace.example,
│   on main.tf line 36, in resource &quot;kubernetes_namespace&quot; &quot;example&quot;:
│   36: resource &quot;kubernetes_namespace&quot; &quot;example&quot; {
</code></pre>
<p>Can you advise what user configuration I'm missing?</p>
<p>Can you advise what is the proper way to implement this script and provision HELM chart into native Kubernetes.</p>

Peter Penzov
<blockquote>
<p>Error: namespaces is forbidden: User &quot;system:serviceaccount:default:cicd&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope</p>
</blockquote>
<p>The service account <code>cicd</code> in namespace <code>default</code> is lacked of permissions. You can first assign <code>cluster-admin</code> permissions to ensure your pipeline is functioning, then trim the permissions gradually according to your use case. Apply the following spec before your pipeline starts:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: &lt;of your own&gt;
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: cicd
  namespace: default
</code></pre>
