<p>I am trying to trigger a job creation from a sensor but I am getting the error below:</p>
<pre><code>   Job.batch is forbidden: User \&quot;system:serviceaccount:samplens:sample-sa\&quot; cannot create resource \&quot;Job\&quot; in API group \&quot;batch\&quot; in the namespace \&quot;samplens\&quot;&quot;,&quot;errorVerbose&quot;:&quot;timed out waiting for the condition: Job.batch is forbidden: User \&quot;system:serviceaccount:samplens:sample-sa\&quot; cannot create resource \&quot;Job\&quot; in API group \&quot;batch\&quot; in the namespace \&quot;samplens\&quot;\nfailed to execute trigger\ngithub.com/argoproj/argo-events/sensors.(*SensorContext).triggerOne\n\t/home/jenkins/agent/workspace/argo-events_master/sensors/listener.go:328\ngithub.com/argoproj/argo-events/sensors.(*SensorContext).triggerActions\n\t/home/jenkins/agent/workspace/argo-events_master/sensors/listener.go:269\ngithub.com/argoproj/argo-events/sensors.(*SensorContext).listenEvents.func1.3\n\t/home/jenkins/agent/workspace/argo-events_master/sensors/listener.go:181\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1357&quot;,&quot;triggerName&quot;:&quot;sample-job&quot;,&quot;triggeredBy&quot;:[&quot;payload&quot;],&quot;triggeredByEvents&quot;:[&quot;38333939613965312d376132372d343262302d393032662d663731393035613130303130&quot;],&quot;stacktrace&quot;:&quot;github.com/argoproj/argo-events/sensors.(*SensorContext).triggerActions\n\t/home/jenkins/agent/workspace/argo-events_master/sensors/listener.go:271\ngithub.com/argoproj/argo-events/sensors.(*SensorContext).listenEvents.func1.3\n\t/home/jenkins/agent/workspace/argo-events_master/sensors/listener.go:181&quot;}
12
</code></pre>
<p>Although I have created a <code>serviceaccount</code>, <code>role</code> and <code>rolebinding</code>.
Here is my <code>serviceaccount</code> creation file:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: sample-sa
  namespace: samplens
</code></pre>
<p>Here is my <code>rbac.yaml</code>:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: sample-role
  namespace: samplens
rules:
  - apiGroups:
      - &quot;&quot;
    resources:
      - pods
    verbs:
      - create
      - delete
      - get
      - watch
      - patch
  - apiGroups:
      - &quot;batch&quot;
    resources:
      - jobs
    verbs:
      - create
      - delete
      - get
      - watch
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sample-role-binding
  namespace: samplens
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: sample-role
subjects:
  - kind: ServiceAccount
    name: sample-sa
    namespace: samplens
</code></pre>
<p>and here is my <code>sensor.yaml</code>:</p>
<pre><code>apiVersion: argoproj.io/v1alpha1
kind: Sensor
metadata:
  name: webhook
spec:
  template:
    serviceAccountName: sample-sa
  dependencies:
    - name: payload
      eventSourceName: webhook
      eventName: devops-toolkit
  triggers:
    - template:
        name: sample-job
        k8s:
          group: batch
          version: v1
          resource: Job
          operation: create
          source:
            resource:
              apiVersion: batch/v1
              kind: Job
              metadata:
                name: samplejob-crypto
                annotations:
                  argocd.argoproj.io/hook: PreSync
                  argocd.argoproj.io/hook-delete-policy: HookSucceeded
              spec:
                ttlSecondsAfterFinished: 100
                serviceAccountName: sample-sa
                template:
                  spec:
                    serviceAccountName: sample-sa
                    restartPolicy: OnFailure
                    containers:
                      - name: sample-crypto-job
                        image: docker.artifactory.xxx.com/abc/def/yyz:master-b1b347a
</code></pre>
<p>Sensor is getting triggered correctly but is failing to create the job.
Can someone please help, what am I missing?</p>

TruckDriver
<p>Posting this as community wiki for better visibility, feel free to edit and expand it.</p>
<p>The original issue <strong>was resolved</strong> by adjusting <code>role</code> and giving <code>*</code> verbs. Which means argo sensor requires more permissions in fact.</p>
<p>This is a working solution for testing environment, while for production RBAC should be used with <code>principle of least privileges</code>.</p>
<p><strong>How to test RBAC</strong></p>
<p>There's a <code>kubectl</code> syntax which allows to test if RBAC (service account + role + rolebinding) was set up as expected.</p>
<p>Below is example how to check if <code>SERVICE_ACCOUNT_NAME</code> in <code>NAMESPACE</code> can create jobs in namespace <code>NAMESPACE</code>:</p>
<p><code>kubectl auth can-i --as=system:serviceaccount:NAMESPACE:SERVICE_ACCOUNT_NAME create jobs -n NAMESPACE</code></p>
<p>The answer will be simple: <code>yes</code> or <code>no</code>.</p>
<p><strong>Usefull links:</strong></p>
<ul>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Using RBAC authorization</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access" rel="nofollow noreferrer">Checking API access</a></li>
</ul>
