403 Forbidden error when trying to access Kubernetes API from a pod

Question

As per this Documentation, I am trying to access the Kuberenetes API from a pod, using the following command

curl --cacert ca.crt -H "Authorization: Bearer $(<token)" https://kubernetes/apis/extensions/v1beta1/namespaces/default/deployments/ballerina-prime/scale

which follows the following template

curl --cacert ca.crt -H "Authorization: Bearer $(<token)" https://kubernetes/apis/extensions/v1beta1/namespaces/{namespace}/deployments/{name}/scale

It throws the following error

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "deployments.extensions \"ballerina-prime\" is forbidden: User \"system:serviceaccount:default:default\" cannot get resource \"deployments/scale\" in API group \"extensions\" in the namespace \"default\"",
  "reason": "Forbidden",
  "details": {
    "name": "ballerina-prime",
    "group": "extensions",
    "kind": "deployments"
  },
  "code": 403
}

Can someone point out where I am making mistake or suggest any other way in which I can access the Kubernetes API?

Update 01

I created a Role as per the Documentation suggested. Following is the manifest I used.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: deployments-and-deployements-scale
rules:
- apiGroups: [""]
  resources: ["deployments", "deployments/scale"]
  verbs: ["get", "list"]

I applied it using this command. kubectl apply -f deployments-and-deployements-scale.yaml. Still I am unable to access the endpoint needed. Where am I making mistake?

Answer 1

First, you are connecting correctly to the kubernetes API!

But the default serviceaccount ("user") you are using does not have the required privileges to perform the operation, that you want to do. (Reading the deployment 'ballerina-prima' in the namespace 'default')

What you need to do: Use a different serviceaccount or grant the permissions that are required to the default service account.

You can find detailed information in the documentation: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

Answer 2

As @Thomas mentioned in the comment below his answer, you need to assign specific Role to the target Service account via RoleBinding resource in order to fix this authorization issue.

In reference to your manifest:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: deployments-and-deployements-scale
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["deployments", "deployments/scale"]
  verbs: ["get", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: deployments-and-deployements-scale-rb
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
roleRef:
  kind: Role
  name: deployments-and-deployements-scale
  apiGroup: ""

You may consider either explicitly set apiGroups: in Role definition, matching particular API groups or widely ["*"] seeking through the all API versions.