dev cannot see the Pods in citadel-1edwb6a:
sh
kubectl get pods --as dev -n citadel-1edwb6aWrite the rule the message asks for, and hand it to dev:
sh
kubectl create role pod-reader --verb=get,list,watch --resource=pods,pods/log -n citadel-1edwb6a
kubectl create rolebinding dev-reads-pods --role=pod-reader --user=dev -n citadel-1edwb6a
kubectl describe role pod-reader -n citadel-1edwb6aThen test the edges of the grant:
sh
kubectl get pods --as dev -n citadel-1edwb6a
kubectl logs deploy/market-web --as dev -n citadel-1edwb6a
kubectl auth can-i get secrets --as dev -n citadel-1edwb6a
kubectl auth can-i list pods --as dev -n default