<p>I want to have a cron job inside specific ns which will be able to delete all the namespace pod, I tried like following</p>
<pre><code>apiVersion: batch/v1
kind: CronJob
metadata:
  name: restart
  namespace: foo
spec:
  concurrencyPolicy: Forbid
  schedule: &quot;*/1 * * * *&quot;
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 600
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: kubectl
              image: bitnami/kubectl:1.22.3
              command:
                - 'kubectl'
                - 'delete'
                - '--all'
                - 'pods'
                - '--namespace=foo'
</code></pre>
<p>and I get an error, any idea how to solve it?
this is pods of a deamonset  (which are in ns foo) that I want to delete from this namespace <code>foo</code> , any idea?</p>
<p>This is the error:</p>
<blockquote>
<p>`Error from server (Forbidden): pods is forbidden: User
&quot;system:serviceaccount:foo:default&quot; cannot list resource &quot;pods&quot; in API
group &quot;&quot; in the namespace &quot;foo ││ Stream closed EOF for
foo/restart-27415740--1-495xg (kubectl)</p>
</blockquote>

Jenney
<p>Your pod is using credentials of service account you are running it as. If you haven't specified service account name - it will use <code>default</code> one, or <code>system:serviceaccount:foo:default</code> in your case</p>
<p>It's generally a bad idea to give any additional rights to default sa, and by default it doesn't have any special privileges, so you need to create an additional service account, grant it rights to delete pods and then configure your cronjob to use it.</p>
<p>Let's create sa named <code>pod-exterminator</code>, since it will <em>exterminate</em> pods:</p>
<pre><code>kubectl create sa pod-exterminator
</code></pre>
<p>We need to create <code>Role</code>, which grants deletion rights</p>
<pre><code>kubectl create role pod-exterminator --verb=delete,list --resource=pods
</code></pre>
<p>We are granting <code>list</code> rights too, because without it <code>--all</code> switch won't work and  you'll have to specify all pod names by yourself</p>
<p>And then a <code>RoleBinding</code>, to grant our sa these rights (foo is your namepsace name):</p>
<pre><code> kubectl create rolebinding --serviceaccount foo:pod-exterminator \
 --role pod-exterminator pod-exterminator
</code></pre>
<p>Now you can specify <code>serivceAccountName</code> in your CronJob spec:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: batch/v1
kind: CronJob
metadata:
  name: restart
  namespace: foo
spec:
  concurrencyPolicy: Forbid
  schedule: &quot;*/1 * * * *&quot;
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 600
      template:
        spec:
          serviceAccountName: pod-exterminator
          restartPolicy: Never
          containers:
            - name: kubectl
              image: bitnami/kubectl:1.22.3
              command:
                - 'kubectl'
                - 'delete'
                - '--all'
                - 'pods'
                - '--namespace=foo'
</code></pre>
<p>See also:</p>
<ul>
<li><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a></li>
</ul>
