The market-api ServiceAccount in citadel-34el4k currently has no rules. It needs to read the Secret db-creds and the logs of Pods. Grant the first by name:
sh
kubectl create role read-db-creds --verb=get --resource=secrets --resource-name=db-creds -n citadel-34el4k
kubectl create rolebinding api-reads-creds --role=read-db-creds --serviceaccount=citadel-34el4k:market-api -n citadel-34el4kAnd the second as a subresource:
sh
kubectl create role log-reader --verb=get --resource=pods/log -n citadel-34el4k
kubectl create rolebinding api-reads-logs --role=log-reader --serviceaccount=citadel-34el4k:market-api -n citadel-34el4kThen check the shape of what you granted:
sh
kubectl auth can-i get secrets db-creds --as system:serviceaccount:citadel-34el4k:market-api -n citadel-34el4k
kubectl auth can-i get secrets tls-cert --as system:serviceaccount:citadel-34el4k:market-api -n citadel-34el4k
kubectl auth can-i list secrets --as system:serviceaccount:citadel-34el4k:market-api -n citadel-34el4k
kubectl auth can-i --list --as system:serviceaccount:citadel-34el4k:market-api -n citadel-34el4k