<p>We're testing Shiny-proxy Kubernetes containers and each application spins it's own container, it's working fine until this part. We have made some changes to create a PVC/PV to persist user specific data for each container, noticed that serviceaccount is unable to create the PVC though I have following roles configured for the account. In general, are there any other steps for making sure that SA is able to access/create PVC?</p>
<p>The PV/PVC are accessible when testing from a normal container, but seem to be an issue with the serviceaccount roles/permissions that's used to create new containers.</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: sp-ns
  name: sp-sa
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;pods/log&quot;, &quot;persistentvolumeclaims&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
</code></pre>
<p>I have verfied that the serviceaccount roles are set right as below commands returns 'yes'.</p>
<pre><code>kubectl auth can-i create pvc --as=system:serviceaccount:sp-ns:sp-sa -n sp-ns
</code></pre>
<p>Error during container creation from the application:</p>
<pre><code>at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
    Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: http://localhost:8001/api/v1/namespaces/sp-ns/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods &quot;sp-pod-92e1efc0-0859-4a87-8b9b-04d6adaa11f5&quot; is forbidden: user &quot;system:serviceaccount:sp-ns:sp-sa&quot; is not an admin and does not have permissions to use host bind mounts for resource .
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:503)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:440)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:406)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:365)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleCreate(OperationSupport.java:234)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleCreate(BaseOperation.java:735)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:325)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:321)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.lambda$createNew$0(BaseOperation.java:336)
    at io.fabric8.kubernetes.api.model.DoneablePod.done(DoneablePod.java:26)
    at eu.openanalytics.containerproxy.backend.kubernetes.KubernetesBackend.startContainer(KubernetesBackend.java:223)
    at eu.openanalytics.containerproxy.backend.AbstractContainerBackend.doStartProxy(AbstractContainerBackend.java:129)
    at eu.openanalytics.containerproxy.backend.AbstractContainerBackend.startProxy(AbstractContainerBackend.java:110)
    ... 95 more
</code></pre>

cnu
<ol>
<li><p>Container is not running as privileged. Use <code>privileged: true</code> in pod spec.</p>
</li>
<li><p>Service account don't have <code>cluster-admin</code> role. Use below to provide permission.</p>
<p><code>kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=sp-ns:sp-sa</code></p>
</li>
</ol>
