What resource and verbs need to be bind to a service account for upload to pod?

[mgubaidullin]

The following example from localhost works fine.
The same code from a Pod inside Kubernetes works if pod run with cluster-admin role bind.
What exact resource and verbs need to be bind to a service account for upload to pod?
I would like to avoid using cluster-admin.

Thanks

package io.fabric8;

import io.fabric8.kubernetes.client.KubernetesClientBuilder;
import io.fabric8.kubernetes.client.KubernetesClient;

import java.io.File;

public class UploadDirectoryToPod {
    public static void main(String[] args) {
        try (KubernetesClient client = new KubernetesClientBuilder().build()) {
            File fileToUpload = new File("/home/rohaan/work/repos/test-dir");
            client.pods().inNamespace("default")  
                    .withName("frontend-6zzh4")   
                    .dir("/tmp/test-dir")        
                    .upload(fileToUpload.toPath()); 
        }
    }
}

[rohanKanojia]

Under the hood, KubernetesClient does exec for uploading file/directory to Pod. If you just want to upload from your application, A role with Pod read, exec access should work.

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-upload
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]

[mgubaidullin]

Thanks @rohanKanojia

I could make it work only with

- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create", "get"]

[mgubaidullin]

@rohanKanojia great examples in your repository. It would be great to have them in the documentation

[rohanKanojia]

Sorry but which repository are you referring to?