Kubernetes pods enter a crashloop state with error

Problem

Google Kubernetes Engine Pods enter a crashloop state with the following error:

level=error msg="Could not fetch node with name {pod_name}from K8s API: nodes \"{node_name}\" is forbidden: User \"system:serviceaccount:system:default\" cannot get resource \"nodes\" in API group \"\" at the cluster scope".

Environment

  • Google Kubernetes Engine version 1.19

Solution

  1. Create a Role or ClusterRole with required permission: get nodes.
  2. Create a Google Kubernetes Engine RoleBinding/ClusterRoleBinding to bind this role to the Service Account.

Cause

By default, when a pod is created without explicitly specifying the service account in the configuration the default service account in the same Kubernetes namespace is assigned, for example: system:serviceaccount:{Account-name}-system:default. This service account lacks the required permissions.