<p>We have a kubernetes cluster with istio proxy running.
At first I created a cronjob which reads from database and updates a value if found. It worked fine.</p>

<p>Then it turns out we already had a service that does the database update so I changed the database code into a service call.</p>

<pre><code>conn := dial.Service("service:3550", grpc.WithInsecure())
client := protobuf.NewServiceClient(conn)

client.Update(ctx)
</code></pre>

<p>But istio rejects the calls with an RBAC error. It just rejects and doesnt say why.</p>

<p>Is it possible to add a role to a cronjob? How can we do that?</p>

<p>The mTLS meshpolicy is PERMISSIVE.</p>

<p>Kubernetes version is 1.17 and istio version is 1.3</p>

<pre><code>API Version:  authentication.istio.io/v1alpha1
Kind:         MeshPolicy
Metadata:
  Creation Timestamp:  2019-12-05T16:06:08Z
  Generation:          1
  Resource Version:    6578
  Self Link:           /apis/authentication.istio.io/v1alpha1/meshpolicies/default
  UID:                 25f36b0f-1779-11ea-be8c-42010a84006d
Spec:
  Peers:
    Mtls:
      Mode:  PERMISSIVE
</code></pre>

<p>The cronjob yaml</p>

<pre><code>Name:                          cronjob
Namespace:                     serve
Labels:                        &lt;none&gt;
Annotations:                   &lt;none&gt;
Schedule:                      */30 * * * *
Concurrency Policy:            Allow
Suspend:                       False
Successful Job History Limit:  1
Failed Job History Limit:      3
Pod Template:
  Labels:  &lt;none&gt;
  Containers:
   service:
    Image:      service:latest
    Port:       &lt;none&gt;
    Host Port:  &lt;none&gt;
    Environment:
      JOB_NAME:                         (v1:metadata.name)
    Mounts:                            &lt;none&gt;
  Volumes:                             &lt;none&gt;
Last Schedule Time:                    Tue, 17 Dec 2019 09:00:00 +0100
Active Jobs:                           &lt;none&gt;
Events:
</code></pre>

<p><em>edit</em>
I have turned off RBA for my namespace in ClusterRBACConfig and now it works. So cronjobs are affected by roles is my conclusion then and it should be possible to add a role and call other services.</p>

Serve Laurijssen
<p>The <code>cronjob</code> needs proper permissions in order to run if RBAC is enabled.</p>

<p>One of the solutions in this case would be to add a <code>ServiceAccount</code> to the <code>cronjob</code> configuration file that has enough privileges to execute what it needs to.</p>

<p>Since You already have existing services in the namespace You can check if You have existing <code>ServiceAccount</code> for specific <code>NameSpace</code> by using:</p>

<pre><code>$ kubectl get serviceaccounts -n serve
</code></pre>

<p>If there is existing <code>ServiceAccount</code> You can add it into Your cronjob manifest yaml file.</p>

<p>Like in this example:</p>

<pre><code>apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: adwords-api-scale-up-cron-job
spec:
  schedule: "*/2 * * * *"
  jobTemplate:
    spec:
      activeDeadlineSeconds: 100
      template:
        spec:
          serviceAccountName: scheduled-autoscaler-service-account
          containers:
          - name: adwords-api-scale-up-container
            image: bitnami/kubectl:1.15-debian-9
            command:
              - bash
            args:
              - "-xc"
              - |
                kubectl scale --replicas=2 --v=7 deployment/adwords-api-deployment
            volumeMounts:
            - name: kubectl-config
              mountPath: /.kube/
              readOnly: true
          volumes:
          - name: kubectl-config
            hostPath:
              path: $HOME/.kube # Replace $HOME with an evident path location
          restartPolicy: OnFailure
</code></pre>

<p>Then under Pod Template there should be Service Account visable:</p>

<pre><code>$ kubectl describe cronjob adwords-api-scale-up-cron-job
Name:                          adwords-api-scale-up-cron-job
Namespace:                     default
Labels:                        &lt;none&gt;
Annotations:                   kubectl.kubernetes.io/last-applied-configuration:
                                 {"apiVersion":"batch/v1beta1","kind":"CronJob","metadata":{"annotations":{},"name":"adwords-api-scale-up-cron-job","namespace":"default"},...
Schedule:                      */2 * * * *
Concurrency Policy:            Allow
Suspend:                       False
Successful Job History Limit:  3
Failed Job History Limit:      1
Starting Deadline Seconds:     &lt;unset&gt;
Selector:                      &lt;unset&gt;
Parallelism:                   &lt;unset&gt;
Completions:                   &lt;unset&gt;
Active Deadline Seconds:       100s
Pod Template:
  Labels:           &lt;none&gt;
  Service Account:  scheduled-autoscaler-service-account
  Containers:
   adwords-api-scale-up-container:
    Image:      bitnami/kubectl:1.15-debian-9
    Port:       &lt;none&gt;
    Host Port:  &lt;none&gt;
    Command:
      bash
    Args:
      -xc
      kubectl scale --replicas=2 --v=7 deployment/adwords-api-deployment

    Environment:  &lt;none&gt;
    Mounts:
      /.kube/ from kubectl-config (ro)
  Volumes:
   kubectl-config:
    Type:            HostPath (bare host directory volume)
    Path:            $HOME/.kube
    HostPathType:    
Last Schedule Time:  &lt;unset&gt;
Active Jobs:         &lt;none&gt;
Events:              &lt;none&gt;
</code></pre>

<p>In case of custom RBAC configuration i suggest referring to <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">kubernetes</a> documentation.</p>

<p>Hope this helps.</p>
