<p>Im trying to schedule a CronJob to launch a kubectl command. The cronjob does not start a pod.
This is my cronjob</p>
<pre><code>apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: mariadump
  namespace: my-namespace
spec:
  schedule: &quot;*/1 * * * *&quot;
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: mariadbdumpsa
          containers:
          - name: kubectl
            image: garland/kubectl:1.10.4
            command:
            - /bin/sh
            - -c
            - kubectl get pods;echo 'DDD'
          restartPolicy: OnFailure 
</code></pre>
<p>I create the cronjob on openshift by:</p>
<pre><code>oc create -f .\cron.yaml
</code></pre>
<p>Obtaining the following results</p>
<pre><code>PS C:\Users\mymachine&gt; oc create -f .\cron.yaml
cronjob.batch/mariadump created
PS C:\Users\mymachine&gt; oc get cronjob -w
NAME        SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
mariadump   */1 * * * *   False     0        &lt;none&gt;          22s
mariadump   */1 * * * *   False     1        10s             40s
mariadump   */1 * * * *   False     0        20s             50s
PS C:\Users\mymachine&gt; oc get pods -w
NAME                         READY   STATUS       RESTARTS   AGE

</code></pre>
<p>The cronjob does not start a pod, but if change to this cronjob(removing the serviceaccount)</p>
<pre><code>apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: mariadump
  namespace: my-namespace
spec:
  schedule: &quot;*/1 * * * *&quot;
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: kubectl
            image: garland/kubectl:1.10.4
            command:
            - /bin/sh
            - -c
            - kubectl get pod;echo 'DDD'
          restartPolicy: OnFailure 
</code></pre>
<p>it works as expected without having permissions.</p>
<pre><code>PS C:\Users\myuser&gt; oc get cronjob -w
NAME        SCHEDULE      SUSPEND   ACTIVE   LAST SCHEDULE   AGE
mariadump   */1 * * * *   False     0        &lt;none&gt;          8s
mariadump   */1 * * * *   False     1        3s              61s
PS C:\Users\myuser&gt; oc get pods -w
NAME                         READY   STATUS             RESTARTS   AGE
mariadump-1616089500-mnfxs   0/1     CrashLoopBackOff   1          8s

PS C:\Users\myuser&gt; oc logs mariadump-1616089500-mnfxs
Error from server (Forbidden): pods is forbidden: User &quot;system:serviceaccount:my-namespace:default&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;my-namespace&quot;
</code></pre>
<p>For giving the cronjob the proper permissions I used this template to create the Role, the rolebinding and the ServiceAccount.</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: my_namespace
  name: mariadbdump
rules:
- apiGroups:
  - extensions
  - apps
  resources:
  - deployments
  - replicasets
  verbs:
  - 'patch'
  - 'get'
​
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: mariadbdump
  namespace: my_namespace
subjects:
- kind: ServiceAccount
  name: mariadbdumpsa
  namespace: my_namespace
roleRef:
  kind: Role
  name: mariadbdump
  apiGroup: &quot;&quot;
  
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mariadbdumpsa
  namespace: my_namespace

</code></pre>
<p>Anyone can help me to know why the cronjob with the ServiceAccount is not working?</p>
<p>Thanks</p>

randex17
<p>With this yaml is actually working</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: my-namespace
  name: mariadbdump
rules:
  - apiGroups:
      - &quot;&quot;
      - ''
    resources:
      - deployments
      - replicasets
      - pods
      - pods/exec
    verbs:
      - 'watch'
      - 'get'
      - 'create'
      - 'list'
      
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: mariadbdump
  namespace: my-namespace
subjects:
  - kind: ServiceAccount
    name: mariadbdumpsa
    namespace: my-namespace
roleRef:
  kind: Role
  name: mariadbdump
  apiGroup: &quot;&quot;
  
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mariadbdumpsa
  namespace: my-namespace
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: mariadump
  namespace: my-namespace
spec:
  schedule: &quot;*/1 * * * *&quot;
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: mariadbdumpsa
          containers:
          - name: kubectl
            image: garland/kubectl:1.10.4
            command:
            - /bin/sh
            - -c
            - kubectl exec $(kubectl get pods | grep Running | grep 'mariadb' | awk '{print $1}') -- /opt/rh/rh-mariadb102/root/usr/bin/mysqldump --skip-lock-tables -h 127.0.0.1 -P 3306 -u userdb --password=userdbpass databasename &gt;/tmp/backup.sql;kubectl cp my-namespace/$(kubectl get pods | grep Running | grep 'mariadbdump' | awk '{print $1}'):/tmp/backup.sql my-namespace/$(kubectl get pods | grep Running | grep 'mariadb' | awk '{print $1}'):/tmp/backup.sql;echo 'Backup done'
          restartPolicy: OnFailure
</code></pre>
