<p>In Azure Kubernetes I want have a pod with jenkins in defualt namespace, that needs read secret from my aplication workspace.</p>
<p>When I tried I get the next error:</p>
<pre><code>Error from server (Forbidden): secrets &quot;myapp-mongodb&quot; is forbidden: User &quot;system:serviceaccount:default:jenkinspod&quot; cannot get resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;myapp&quot;
</code></pre>
<p>How I can bring access this jenkisn pod to read secrets in 'myapp' namespace</p>

David Burgos
<p><code>secret</code> is a namespaced resource and can be accessed via proper rbac permissions. However any improper rbac permissions may lead to leakage.</p>
<p>You must <code>role bind</code> the pod's associated service account. Here is a complete example. I have created a new service account for role binding in this example. However, you can use the default <code>service account</code> if you want.</p>
<p>step-1: create a namespace called <code>demo-namespace</code></p>
<pre><code>kubectl create ns demo-namespace
</code></pre>
<p>step-2: create a secret in <code>demo-namespace</code>:</p>
<pre><code>kubectl create  secret generic  other-secret -n demo-namespace  --from-literal foo=bar
secret/other-secret created
</code></pre>
<p>step-2: Create a service account(<code>my-custom-sa</code>) in the <code>default</code> namespace.</p>
<pre><code>kubectl create sa my-custom-sa
</code></pre>
<p>step-3: Validate that, by default, the service account you created in the last step has no access to the secrets present in <code>demo-namespace</code>.</p>
<pre><code>kubectl auth can-i get secret -n demo-namespace --as system:serviceaccount:default:my-custom-sa
no
</code></pre>
<p>step-4: Create a cluster role with permissions of <code>get</code> and <code>list</code> secrets from <code>demo-namespace</code> namespace.</p>
<pre><code>kubectl create clusterrole role-for-other-user --verb get,list --resource secret
clusterrole.rbac.authorization.k8s.io/role-for-other-user created
</code></pre>
<p>step-5: Create a rolebinding to bind the cluster role created in last step.</p>
<pre><code> kubectl create  rolebinding role-for-other-user -n demo-namespace --serviceaccount default:my-custom-sa --clusterrole  role-for-other-user
 rolebinding.rbac.authorization.k8s.io/role-for-other-user created
</code></pre>
<p>step-6: validate that the service account in the default ns now has access to the secrets of <code>demo-namespace</code>. (note the difference from step 3)</p>
<pre><code>kubectl auth can-i get secret -n demo-namespace --as system:serviceaccount:default:my-custom-sa
yes
</code></pre>
<p>step-7: create a pod in default namsepace and mount the service account you created earlier.</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: my-pod
  name: my-pod
spec:
  serviceAccountName: my-custom-sa
  containers:
  - command:
    - sleep
    - infinity
    image: bitnami/kubectl
    name: my-pod
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}
</code></pre>
<p>step-7: Validate that you can read the secret of <code>demo-namespace</code> from the pod in the default namespace.</p>
<pre><code> curl -sSk -H &quot;Authorization: Bearer $(cat /run/secrets/kubernetes.io/serviceaccount/token)&quot;       https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_PORT_443_TCP_PORT/api/v1/namespaces/demo-namespace/secrets
{
  &quot;kind&quot;: &quot;SecretList&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {
    &quot;resourceVersion&quot;: &quot;668709&quot;
  },
  &quot;items&quot;: [
    {
      &quot;metadata&quot;: {
        &quot;name&quot;: &quot;other-secret&quot;,
        &quot;namespace&quot;: &quot;demo-namespace&quot;,
        &quot;uid&quot;: &quot;5b3b9dba-be5d-48cc-ab16-4e0ceb3d1d72&quot;,
        &quot;resourceVersion&quot;: &quot;662043&quot;,
        &quot;creationTimestamp&quot;: &quot;2022-08-19T14:51:15Z&quot;,
        &quot;managedFields&quot;: [
          {
            &quot;manager&quot;: &quot;kubectl-create&quot;,
            &quot;operation&quot;: &quot;Update&quot;,
            &quot;apiVersion&quot;: &quot;v1&quot;,
            &quot;time&quot;: &quot;2022-08-19T14:51:15Z&quot;,
            &quot;fieldsType&quot;: &quot;FieldsV1&quot;,
            &quot;fieldsV1&quot;: {
              &quot;f:data&quot;: {
                &quot;.&quot;: {},
                &quot;f:foo&quot;: {}
              },
              &quot;f:type&quot;: {}
            }
          }
        ]
      },
      &quot;data&quot;: {
        &quot;foo&quot;: &quot;YmFy&quot;
      },
      &quot;type&quot;: &quot;Opaque&quot;
    }
  ]
}
</code></pre>
