<p>I playing with operator-sdk and trying to issue an API call to Kubelet on a specific node.</p>
<p>My API calls result in result code 403 - Forbidden.</p>
<p>Below is the relevant code piece:</p>
<pre class="lang-golang prettyprint-override"><code>clientset, err := kubernetes.NewForConfig(r.Config)
    if err != nil {
        logger.Info(&quot;Failed to get clientset&quot;)
        return ctrl.Result{}, err
    }
    logger.Info(&quot;Successfully got clientset&quot;)

    restClient := clientset.CoreV1().RESTClient()

    for _, container := range pod.Spec.Containers {
        kubeletAPI := fmt.Sprintf(&quot;http://localhost:8080/api/v1/nodes/%s/proxy/checkpoint/%s/%s/%s&quot;, pms.Spec.SourceNode, pms.Spec.Namespace, pms.Spec.PodName, container.Name)
        result := restClient.Post().AbsPath(kubeletAPI).Do(context.TODO())
        rawBody, _ := result.Raw()
        if result.Error() != nil {
            logger.Info(&quot;Failed to checkpoint container&quot;, &quot;namespace&quot;, pms.Spec.Namespace, &quot;podName&quot;, pms.Spec.PodName, &quot;containerName&quot;, container.Name)
        } else {
            logger.Info(&quot;Succeded to checkpoint container&quot;)
        }

        logger.Info(&quot;Checkpoint result&quot;, &quot;result&quot;, result, &quot;response&quot;, string(rawBody))

    }
</code></pre>
<p>Below is the role.yaml:</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: manager-role
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - endpoints
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - nodes
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - nodes/proxy
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - pods
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - &quot;&quot;
  resources:
  - services
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - migration.pantarhei.ai
  resources:
  - podmigrations
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - migration.pantarhei.ai
  resources:
  - podmigrations/finalizers
  verbs:
  - update
- apiGroups:
  - migration.pantarhei.ai
  resources:
  - podmigrations/status
  verbs:
  - get
  - patch
  - update
</code></pre>
<p>Below is the response:</p>
<pre><code>2023-09-25T17:34:07Z    INFO    Checkpoint result       {&quot;controller&quot;: &quot;podmigration&quot;, &quot;controllerGroup&quot;: &quot;migration.pantarhei.ai&quot;, &quot;controllerKind&quot;: &quot;PodMigration&quot;, &quot;PodMigration&quot;: {&quot;name&quot;:&quot;podmigration-sample&quot;,&quot;namespace&quot;:&quot;pantarhei-operator-system&quot;}, &quot;namespace&quot;: &quot;pantarhei-operator-system&quot;, &quot;name&quot;: &quot;podmigration-sample&quot;, &quot;reconcileID&quot;: &quot;237abbaf-36ac-4562-9182-b183ba8e6e70&quot;, &quot;result&quot;: {}, &quot;response&quot;: &quot;{\&quot;kind\&quot;:\&quot;Status\&quot;,\&quot;apiVersion\&quot;:\&quot;v1\&quot;,\&quot;metadata\&quot;:{},\&quot;status\&quot;:\&quot;Failure\&quot;,\&quot;message\&quot;:\&quot;forbidden: User \\\&quot;system:serviceaccount:pantarhei-operator-system:pantarhei-operator-controller-manager\\\&quot; cannot post path \\\&quot;/http:/localhost:8080/api/v1/nodes/pantarhei-dp1/proxy/checkpoint/pantarhei-operator-system/ubuntu/ubuntu-container\\\&quot;\&quot;,\&quot;reason\&quot;:\&quot;Forbidden\&quot;,\&quot;details\&quot;:{},\&quot;code\&quot;:403}\n&quot;}
</code></pre>
<p>I cannot understand what permission I am missing.</p>

triple fault
<p><code>kubelet</code> agents only communicate with the k8s API server. Whatever the thing you are trying to get done with <code>kubelet</code>, should be possible with k8s API server access. In the operator-pattern, the operator pods don't do any direct communication with <code>kubelet</code>.</p>
<p>See <a href="https://github.com/cncf/tag-app-delivery/blob/main/operator-wg/whitepaper/Operator-WhitePaper_v1-0.md#security" rel="nofollow noreferrer">CNCF Operator White Paper </a>'s security section,</p>
<p><a href="https://i.stack.imgur.com/A1GiM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/A1GiM.png" alt="enter image description here" /></a></p>
