GKE - Error while watching kubernetes events: Invalid status code: 403 Forbidden

[kammar87]

Cert-manager is able to create new cert for the certificates already created in the k8s cluster. However I found error mentioned in the subject. Firstly I tried to use proposed RBAC roles in the repo, however it didn't work. Next I tried to add extra permission, by creating the following cluster role and bind it to service account, which didn't help as well:

kind: ServiceAccount
metadata:
  name: kube-cert-account
  namespace: default
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kube-cert-role
rules:
  - apiGroups: ["*"]
    resources: ["certificates"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["*"]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "update", "delete"]
  - apiGroups: ["*"]
    resources: ["events"]
    verbs: ["get", "list", "create", "watch"]
  - apiGroups: ["*"]
    resources: ["pods", "replicationcontrollers"]
    verbs: ["get", "watch", "list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kube-cert-role-service-account
subjects:
  - kind: ServiceAccount
    namespace: default
    name: kube-cert-account
roleRef:
  kind: ClusterRole
  name: kube-cert-role
  apiGroup: rbac.authorization.k8s.io 

Do you have any idea why is it still complaining?

[luna-duclos]

I'm sorry, this project is no longer maintained. But you should be able to get a good idea of the watches by looking at the source code.