Error on service account

[mimmus]

I'm seeing this message:
ERR error fetching referenced service account, continue without service account imagePullSecrets error="serviceaccounts \"myapp-services\" is forbidden: User \"system:serviceaccount:k8s-image-swapper:k8s-image-swapper\" cannot get resource \"serviceaccounts\" in API group \"\" in the namespace \"myns\""
at every access.

To give needed permissions to k8s-image-swapper, I'm using an EC2 Role.

[mvchris]

You need to create a ClusterRole with the appropriate permissions, for example in Terraform:

rule {
api_groups = [""]
resources = [
"serviceaccounts",
"secrets",
]
verbs = [""]
}
and bind it to the service account using a ClusterRoleBinding. That's what did it for me. :]

[mimmus]

Thank you @mvchris ! I reduced verbs to ["get", "list"]

Edit
setting secretReader in values.yaml (if using Helm) automatically create ClusterRoles/ClusterRoleBinding:

secretReader:
  enabled: true