Do I Need Both RBAC and IAM for Service Account Authorization in GKE?

When you use a service account token in your kubeconfig, the Kubernetes API server will authorize your requests based on the RBAC (Role-Based Access Control) rules in the cluster. By default, service accounts outside the kube-system namespace have no permissions, so simply including a token with a couple of permissions (like cluster.deployments.get and container.clusters.get) is not enough for operations such as listing deployments.

In other words, you will need to set up RBAC within the cluster to grant your service account the necessary permissions. For example, if you want your service account to list deployments in a particular namespace, you can create a Role and a RoleBinding (or ClusterRole and ClusterRoleBinding if the actions should span namespaces).

A simple example to grant read-only access on deployments in a namespace would be:

BASHCopied
kubectl create rolebinding deployment-reader \
  --role=view \
  --serviceaccount=<namespace>:<serviceaccount-name> \
  --namespace=<namespace>

Make sure that:

• The namespace in the RoleBinding matches where you intend to list deployments.
• The correct service account is specified.

Without appropriate RBAC bindings, the API server will deny your request even though your token may have certain IAM-level permissions (in the case of GKE). So in your go code workflow, after obtaining your kubeconfig with the service account token, you must ensure that the service account has been granted the appropriate RBAC permissions to perform operations like listing deployments.