Cannot get secrets in Kubernetes

[Slyke]

When attempting to setup lnd on my cluster, I'm getting the following error:

/ # bash init-wallet-k8s.sh --bitcoin.mainnet ... --wallet-unlock-password-file=/tmp/wallet-password
[STARTUP] Asserting wallet password exists in secret lnd-wallet-secret
2023-02-10 06:13:00.905 LNDINIT: Version 0.1.8-beta commit=, debuglevel=debug
2023-02-10 06:13:00.905 LNDINIT: Reading secret from stdin
2023-02-10 06:13:00.907 LNDINIT: Storing key with name walletpassword to secret lnd-wallet-secret in namespace cryptocurrency
2023-02-10 06:13:00.908 LNDINIT: Creating k8s cluster config
2023-02-10 06:13:00.908 LNDINIT: Creating k8s cluster client
2023-02-10 06:13:00.909 LNDINIT: Cluster client created successfully
2023-02-10 06:13:00.909 LNDINIT: Attempting to load secret lnd-wallet-secret from namespace cryptocurrency
2023-02-10 06:13:00.944 LNDINIT: Runtime error: error storing secret lnd-wallet-secret key walletpassword: error querying secret existence: secrets "lnd-wallet-secret" is forbidden: User "system:serviceaccount:cryptocurrency:lnd-provision-account" cannot get resource "secrets" in API group "" in the namespace "cryptocurrency"

My roles and SA is a copy/paste from the example, I just changed the namespace:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: lnd-provision-account
  namespace: cryptocurrency


---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: lnd-update-secrets-role
  namespace: cryptocurrency
rules:
  - apiGroups: [ "" ]
    resources: [ "secrets" ]
    verbs: [ "get", "list", "watch", "update" ]


---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: lnd-update-secrets-role-binding
  namespace: cryptocurrency
roleRef:
  kind: Role
  name: lnd-update-secrets-role
  apiGroup: rbac.authorization.k8s.io
  namespace: cryptocurrency
subjects:
  - kind: ServiceAccount
    name: lnd-provision-account
    namespace: cryptocurrency

Inside the init-wallet-k8s.sh file, I updated the env vars to be in my namespace:

...
WALLET_SECRET_NAMESPACE=${WALLET_SECRET_NAMESPACE:-cryptocurrency}
...
RPC_SECRETS_NAMESPACE=${RPC_SECRETS_NAMESPACE:-cryptocurrency}
...

More details:

$ kubectl describe sa -n cryptocurrency lnd-provision-account
Name:                lnd-provision-account
Namespace:           cryptocurrency
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   lnd-provision-account-token-97bks
Tokens:              lnd-provision-account-token-97bks
Events:              <none>

$ kubectl describe roles -n cryptocurrency lnd-update-secrets-role
Name:         lnd-update-secrets-role
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  secrets    []                 []              [get list watch update]

$ kubectl describe rolebinding lnd-update-secrets-role-binding -n cryptocurrency
Name:         lnd-update-secrets-role-binding
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  lnd-update-secrets-role
Subjects:
  Kind            Name                   Namespace
  ----            ----                   ---------
  ServiceAccount  lnd-provision-account  cryptocurrency

[Slyke]

Ok, the documentation is missing some verbs in the Role:

    verbs: [ "get", "list", "create", "watch", "update", "patch" ]