<p>I have kubernetes cluster which I created with <a href="https://github.com/kubernetes/kops" rel="nofollow noreferrer">kops</a> on AWS. I'm trying to use <a href="https://github.com/box/kube-applier" rel="nofollow noreferrer">kube-applier</a> to apply <code>yaml</code> configuration to my cluster: I created a deployment with <code>kube-applier</code>:</p>
<pre><code>apiVersion: &quot;extensions/v1beta1&quot;
kind: &quot;Deployment&quot;
metadata:
  name: &quot;kube-applier&quot;
  namespace: &quot;kube-system&quot;
spec:
  # spec
</code></pre>
<p>and started it in <code>kube-system</code> namespaces as suggested in a README:
<code>kubectl --namespace=kube-system apply -f deployment.yaml</code>.</p>
<p>But then <code>kube-applier</code> fails with this error when received new file to apply:</p>
<pre><code>$ kubectl apply -f /git/deployment.yaml
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc43034ca91 0xc43034ca91 kube-system kube-applier /git/applier-deployment.yaml 0xc421432531  false}
from server for: &quot;/git/deployment.yaml&quot;: deployments.extensions &quot;kube-applier&quot; is forbidden: User &quot;system:serviceaccount:kube-system:default&quot; cannot get deployments.extensions in the namespace &quot;kube-system&quot;
</code></pre>
<p>How can I grant permissions to <code>kube-applier</code> pod to apply configurations in other namespaces?</p>
<p>Kubernetes version: <code>Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;9&quot;, GitVersion:&quot;v1.9.6&quot;, GitCommit:&quot;9f8ebd171479bec0ada837d7ee641dec2f8c6dd1&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2018-03-21T15:13:31Z&quot;, GoVersion:&quot;go1.9.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}</code></p>

Kirill
<blockquote>
  <p>How can I grant permissions to kube-applier pod to apply configurations in other namespaces?</p>
</blockquote>

<p>Create, or find, a <code>ClusterRole</code> with the correct resource permissions, then bind the <code>ServiceAccount</code> to it using a <code>ClusterRoleBinding</code> like so</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    # C.R.B. don't have a "namespace:"
    name: my-kube-applier
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: default
  namespace: kube-system
</code></pre>

<p><strong>BUT</strong>, as @jhernandez said, you will really want to create a dedicated <code>ServiceAccount</code> for <code>kube-applier</code> instead of granting what I presume is a very, very privileged <code>ClusterRole</code> to the <code>default</code> S.A. (which is what I did in the <em>example</em> above, but you should not do for real)</p>

<p>Creating a new <code>ServiceAccount</code> is super cheap: <code>kubectl -n kube-system create sa kube-applier</code> and then replace <code>name: default</code> with <code>name: kube-applier</code> in the <code>subjects:</code> block above.</p>

<p>Ideally one would create a customized least-privilege <code>ClusterRole</code> rather than using a massive hammer like <code>cluster-admin</code>, but generating the <em>correct</em> one would take some serious typing, so I'll leave that to your discretion.</p>
