I am trying to create a k8s service using coder template in coder namespace got permission issue for default namespace. #16175

creeram · 2025-01-17T13:13:40Z

creeram
Jan 17, 2025

Error: Error: services is forbidden: User "system:serviceaccount:coder:coder" cannot create resource "services" in API group "" in the namespace "default"

k8s service manifest in coder template.

resource "kubernetes_service" "main_service" {
  metadata {
    name      = "coder-service-demo"
    namespace = "coder"
    labels = {
      "app" = "coder-service-demo"
    }
  }
  
  spec {
    selector = {
      app = coder-demo
    }
    port {
      port        = 8080
      target_port = 80
    }

  }
}

why it it trying to create in default when i defined namespace="coder" ?

HansUweRempler · 2025-02-01T16:40:38Z

HansUweRempler
Feb 1, 2025

@creeram I have/had the same issue - the main.tf Terraform template in Coder is not using the given namespace.

Anyway, if you're looking for a workaround you could add an additional extended ClusterRole plus a ClusterRoleBinding. I used the role "coder-workspace-perms" as input.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    field.cattle.io/description: Uwe's mod for Devcontainers (Kubernetes) Coder template error
  creationTimestamp: '2025-02-01T16:25:29Z'
  managedFields:
    - apiVersion: rbac.authorization.k8s.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:field.cattle.io/description: {}
        f:rules: {}
      manager: agent
      operation: Update
      time: '2025-02-01T16:30:44Z'
  name: coder-persistentVolumeClaims
  resourceVersion: '1518326'
  uid: 170ceb5a-b0ac-4e1f-8b7c-7e95595e34b4
rules:
  - apiGroups:
      - ''
    resources:
      - pods
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ''
    resources:
      - persistentvolumeclaims
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - apps
    resources:
      - deployments
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: '2025-02-01T16:28:33Z'
  managedFields:
    - apiVersion: rbac.authorization.k8s.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:roleRef: {}
        f:subjects: {}
      manager: agent
      operation: Update
      time: '2025-02-01T16:28:33Z'
  name: coder-persistentVolumeClaims
  resourceVersion: '1517844'
  uid: 17279a4f-6fc2-406f-a6e7-6bbce5009e7a
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: coder-persistentVolumeClaims
subjects:
  - kind: ServiceAccount
    name: coder
    namespace: coder

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

I am trying to create a k8s service using coder template in coder namespace got permission issue for default namespace. #16175

{{title}}

Replies: 1 comment

{{title}}

Select a reply

I am trying to create a k8s service using coder template in coder namespace got permission issue for default namespace. #16175

creeram Jan 17, 2025

Replies: 1 comment

HansUweRempler Feb 1, 2025

creeram
Jan 17, 2025

HansUweRempler
Feb 1, 2025