Kubernetes Job Containers - (Forbidden): jobs.batch "example-migration" is forbidden

For our database migrations we are usingKubernetes Jobs and init containers as discussed here.

However when we tried to deploy the job container, it failed with the following error:

Error from server (Forbidden): jobs.batch "example-migration" is forbidden: User "system:serviceaccount:example-ns:default" cannot get resource "jobs" in API group "batch" in the namespace "example-ns": Azure does not have opinion for this user.

To read and list jobs, the deployment is using the default service account in the “example-ns” namespace. This default service account does not have the necessary api rights in the kubernetes cluster.

To fix it we created a new service account, role and role binding:

	kind: Role
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	name: batch-jobs
	rules:
	- apiGroups:
	- "batch"
	resources:
	- jobs
	verbs:
	- get
	- list
	- watch

view raw role.yaml hosted with ❤ by GitHub

	kind: RoleBinding
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	name: batch-jobs-role-binding
	namespace: example-ns
	subjects:
	- kind: ServiceAccount
	name: batch-jobs-service-account
	namespace: example-ns
	roleRef:
	apiGroup: rbac.authorization.k8s.io
	kind: Role
	name: batch-jobs

view raw rolebinding.yaml hosted with ❤ by GitHub

	apiVersion: v1
	kind: ServiceAccount
	metadata:
	name: batch-jobs-service-account
	namespace: example-ns

view raw ServiceAccount.yaml hosted with ❤ by GitHub

After doing that, we had to update our deployment to use this service account:

	spec:
	serviceAccountName: batch-jobs-service-account
	containers:
	...

view raw deployment.yaml hosted with ❤ by GitHub