Adding Roles for Kubernetes Waypoint Runner

permissions.md

Using Hashicorp Waypoint runner for Kubernetes is pretty straight forward... but sometimes runs into permissions errors.

Specifically jobs.batch is forbidden: User "system:serviceaccount:waypoint:waypoint-runner" cannot create resource "jobs" in API

You need to

• create a role with access to the jobs.batch api
• bind it to the service account

You can do this as follows

Create a Role

echo """apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: default
  name: batch-role 
rules:
 - apiGroups: ["", "extensions", "apps", "batch"]
   resources: ["*"]
   verbs: ["*"] """ > batch-role.yaml
  
# apply it 
kubectl apply -f batch-role.yaml

# check it 
kubectl get clusterrole | grep "batch-role"

Bind the Role

# apply
kubectl create clusterrolebinding batch-role \
  --clusterrole=batch-role \
  --serviceaccount=waypoint:waypoint-runner
  
# check 
kubectl get clusterrolebinding | grep "batch-role"