<p>I'm trying to create a proper set of permissions for a serviceAccount.
For some reason it seems to ignore the permissions I granted and gives me a bunch of errors because of that. I don't see what I did wrong. Did I apply something in the wrong namespace or similar?</p>

<p>My Role:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: r-wercker-ingress-new
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: ["extensions"]
  resources: ["deployments"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["create", "delete", "patch", "update", "get", "watch", "list"]
</code></pre>

<p>My RoleBinding:</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: r-wercker-ingress-new
subjects:
- kind: ServiceAccount
  name: wercker
  namespace: kube-ingress
roleRef:
  kind: Role
  name: r-wercker-ingress-new
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>kubectl output about role</p>

<pre><code>kubectl describe role r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"default"},"rules":[...
PolicyRule:
  Resources                             Non-Resource URLs  Resource Names  Verbs
  ---------                             -----------------  --------------  -----
  configmaps                            []                 []              [create delete patch update get watch list]
  deployments.extensions                []                 []              [create delete patch update get watch list]
  horizontalpodautoscalers.autoscaling  []                 []              [create delete patch update get watch list]
  namespaces                            []                 []              [create delete patch update get watch list]
  serviceaccounts                       []                 []              [create delete patch update get watch list]
  services                              []                 []              [create delete patch update get watch list]
</code></pre>

<p>kubectl output about RoleBinding</p>

<pre><code>kubectl describe rolebinding r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"default"},"r...
Role:
  Kind:  Role
  Name:  r-wercker-ingress-new
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  wercker  kube-ingress
</code></pre>

<p>Error output when trying to apply my resources:</p>

<pre><code>Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d380 0xc4205982a0  kube-ingress resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4370  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": namespaces "kube-ingress" is forbidden: User "system:serviceaccount:default:wercker" cannot get namespaces in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d440 0xc420599340 kube-ingress nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc420df43f8  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": serviceaccounts "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get serviceaccounts in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d680 0xc4201e55e0  nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4500  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": clusterroles.rbac.authorization.k8s.io "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get clusterroles.rbac.authorization.k8s.io at the cluster scope
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d740 0xc4204c4770  nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4578  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": clusterrolebindings.rbac.authorization.k8s.io "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get clusterrolebindings.rbac.authorization.k8s.io at the cluster scope
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d800 0xc4204c5e30 kube-ingress ingress-nginx resources/kube-ingress/ingress-controller-nginx.yml 0xc420df45f0  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": services "ingress-nginx" is forbidden: User "system:serviceaccount:default:wercker" cannot get services in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d8c0 0xc420134a10 kube-ingress ingress-nginx resources/kube-ingress/ingress-controller-nginx.yml 0xc420df4660  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": configmaps "ingress-nginx" is forbidden: User "system:serviceaccount:default:wercker" cannot get configmaps in the namespace "kube-ingress"
Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42062d980 0xc420145ab0 kube-ingress ingress-nginx resources/kube-ingress/ingress-controller-nginx.yml 0xc420df46f0  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": deployments.extensions "ingress-nginx" is forbidden: User "system:serviceaccount:default:wercker" cannot get deployments.extensions in the namespace "kube-ingress"
</code></pre>

<p><strong>Edit 1:</strong> I tried moving the resources into the corresponding namespaces but still get the same errors.</p>

<pre><code>kubectl --namespace kube-ingress get role
NAME                    AGE
r-wercker-ingress-new   2m

kubectl --namespace kube-ingress describe role r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"kube-ingress"},"rul...
PolicyRule:
  Resources                             Non-Resource URLs  Resource Names  Verbs
  ---------                             -----------------  --------------  -----
  configmaps                            []                 []              [create delete patch update get watch list]
  deployments.extensions                []                 []              [create delete patch update get watch list]
  horizontalpodautoscalers.autoscaling  []                 []              [create delete patch update get watch list]
  namespaces                            []                 []              [create delete patch update get watch list]
  serviceaccounts                       []                 []              [create delete patch update get watch list]
  services                              []                 []              [create delete patch update get watch list]

kubectl --namespace kube-ingress get rolebinding
NAME                              AGE
r-wercker-ingress-new             2m

kubectl --namespace kube-ingress describe rolebinding r-wercker-ingress-new
Name:         r-wercker-ingress-new
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"r-wercker-ingress-new","namespace":"kube-ingress...
Role:
  Kind:  Role
  Name:  r-wercker-ingress-new
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  wercker  kube-ingress
</code></pre>

<p>Still gives:</p>

<pre><code>Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc420d14840 0xc420382620 kube-ingress nginx-ingress-controller resources/kube-ingress/ingress-controller-nginx.yml 0xc42160e560  false}
from server for: "resources/kube-ingress/ingress-controller-nginx.yml": serviceaccounts "nginx-ingress-controller" is forbidden: User "system:serviceaccount:default:wercker" cannot get serviceaccounts in the namespace "kube-ingress"
</code></pre>

<p>I have deleted and re-created the Roles and RoleBindings</p>

soupdiver
<p>Yes, it looks like you are applying the resources into a wrong namespace. If you want to set these permissions up for the namespace <code>kube-ingress</code>, you need to create the resources in this namespace.</p>

<p>So you would add this line to the metadata of your <code>Role</code>, <code>RoleBinding</code> and <code>ServiceAccount</code>:</p>

<pre><code>namespace: kube-ingress
</code></pre>

<p>Using <code>Role</code> and <code>RoleBinding</code>, you define permissions for a single namespace. If you would like to create cluster-wide permissions, you can use <code>ClusterRole</code> and <code>ClusterRoleBinding</code>. </p>

<p>You can also create a common case <code>ClusterRole</code> and then bind it to a single namespace with <code>RoleBinding</code>. The k8s docs are very helpful in this regard: <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole</a></p>
