<p>I'm trying to access the Kubernetes API in order to discover pods from within a deployed container. Although I'll do this programatically, right now, I'm just using cURL to check for issues.</p>

<p>I run this from a pod terminal:</p>

<pre><code>curl -vvv -H "Authorization: Bearer $(&lt;/var/run/secrets/kubernetes.io/serviceaccount/token)" "https://kubernetes.default/api/v1/namespaces/$(&lt;/var/run/secrets/kubernetes.io/serviceaccount/namespace)/endpoints" --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
</code></pre>

<p>And I get a 403 result:</p>

<pre><code>* About to connect() to kubernetes.default port 443 (#0)
*   Trying 172.30.0.1...
* Connected to kubernetes.default (172.30.0.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  CApath: none
* NSS: client certificate not found (nickname not specified)
* SSL connection using TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
* Server certificate:
*       subject: CN=10.0.75.2
*       start date: Nov 23 16:55:27 2017 GMT
*       expire date: Nov 23 16:55:28 2019 GMT
*       common name: 10.0.75.2
*       issuer: CN=openshift-signer@1511456125
&gt; GET /api/v1/namespaces/myproject/endpoints HTTP/1.1                                                                                            s/$(&lt;/var/run/secrets/kubernetes.io/serv
&gt; User-Agent: curl/7.29.0
&gt; Host: kubernetes.default
&gt; Accept: */*&gt; Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJteXByb2plY3QiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZGVmYXVsdC10b2tlbi00cXZidCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMjg3NzAzYjEtZDA4OC0xMWU3LTkzZjQtNmEyNGZhYWZjYzQxIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Om15cHJvamVjdDpkZWZhdWx0In0.yl2HUhmxjrb4UqkAioq1TixWl_YqUPoxSvQPPSgl9Hzr97Hjm7icdL_mdptwEnOSErfzqSUBiMKJcIRdIa3Z7mfkgEk-f2H-M7TUU8GpXmD2Zex6Bcn_dq-Hsoed6W2PYpeFDoy98p5rSNTUL5MPMATOodeAulB0NG_zF01-8qTbLO_I6FRa3BCVXVMaZWBoZgwZ1acQbd4fJqDRsYmQMSi5P8a3nYgjBdifkQeTTb3S8Kmnszct41LoUlh9Xv29YVEyr1uQc5DSLAgQKj_NdSxkVq-MJP8z1PWV3OmHULNChocXr7RGKaNwlVpwpgNqsDAOqIyE1ozxlntIrotLBw
&gt;
&lt; HTTP/1.1 403 Forbidden
&lt; Cache-Control: no-store
&lt; Content-Type: application/json
&lt; Date: Thu, 23 Nov 2017 22:18:01 GMT
&lt; Content-Length: 282
&lt;
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "User \"system:serviceaccount:myproject:default\" cannot list endpoints in project \"myproject\"",
  "reason": "Forbidden",
  "details": {
    "kind": "endpoints"
  },
  "code": 403
}
* Connection #0 to host kubernetes.default left intact
</code></pre>

<p>I've tried to access a number of resources, like, endpoints, pods, etc. I've also omitted the namespace (as to access the whole cluster resources) to no avail. </p>

<p>I'm currently using OpenShift Origin, clean (just ran <code>oc cluster up</code> and deployed a test image to access the terminal in the web console).</p>

<p>It looks like you're on fully RBAC enabled cluster, and your default service account <code>system:serviceaccount:myproject:default</code>, as expected, is unauthorised. You should create and use dedicated service account for this pod and explicitly grant it access to what it needs to read.</p>

<p><a href="https://kubernetes.io/docs/admin/authorization/rbac/" rel="nofollow noreferrer">https://kubernetes.io/docs/admin/authorization/rbac/</a></p>
