want to get nodes through workflows.

[nishit93-hub]

Hi There,

I trying to get nodes through workflows. I am getting this error

Error from server (Forbidden): nodes is forbidden: User "system:serviceaccount:argo:internal-kubectl" cannot list resource "nodes
" in API group "" at the cluster scope

Even though i add RBAC rule to list nodes. Below is the RBAC rule

apiVersion: v1
kind: ServiceAccount
metadata:
  name: internal-kubectl
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: modify-pods
rules:
  - apiGroups: [""]
    resources:
      - pods
    verbs:
      - get
      - list
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: modify-pods-to-sa
subjects:
  - kind: ServiceAccount
    name: internal-kubectl
roleRef:
  kind: Role
  name: modify-pods
  apiGroup: rbac.authorization.k8s.io 

[terrytangyuan]

You service account only has permission on pods but looks like it needs permission to list nodes.

[nishit93-hub]

Yes, but when i do kubectl get pods it show pods of argo workflow namespace pods. And if i do get pods of another namespace it gives me the same errors.

How can i grant permission of all namespace in rbac rule?

[terrytangyuan]

Perhaps you are looking for cluster scope installation: https://github.com/argoproj/argo-workflows/blob/master/manifests/install.yaml

[nishit93-hub]

Ok, for this is i need to add SSO to log in or any default login credentials i can use?

[terrytangyuan]

I don't understand your question but you can find information on SSO here: https://argoproj.github.io/argo-workflows/argo-server-sso/. Please file separate discussions for other unrelated questions and try use the thread.

[nishit93-hub]

Hi @terrytangyuan I have installed the cluster scope Argo workflow. However, still have the same issue. I am adding the RBAC rule to the Argo namespace. Do I need to add a rule in the default namespace or to other namespaces?

[terrytangyuan]

You need namespace: argo in the following:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argo-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-cluster-role
subjects:
- kind: ServiceAccount
  name: argo
  namespace: argo

[nishit93-hub]

Okay, let me give it a try. Thanks

[nishit93-hub]

Thank you, now I am able to get pods from other namespaces too.

[nishit93-hub]

@terrytangyuan Hey, i have another question or issue that I am mentioning resource that i want to get like below

rules:
  - apiGroups: [""]
    resources: ["services", "endpoints", "pods"]
    verbs: [""]

Still, i am able to access the pods only.