<p>I'm trying to create a cluster role with permissions to watch events, but it seems that I'm missing something.</p>

<p>I'm using the following:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: watch-events
  namespace: test
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: watch-events-cluster
rules:
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: watch-events-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: watch-events-cluster
subjects:
- kind: ServiceAccount
  name: watch-events
  namespace: test
</code></pre>

<p>No mater what I try with <code>kubectl auth can-i watch events --as watch-events</code> I always get a <strong>no</strong>.</p>

<p>Am I missing something?</p>

<p>The RBAC is correct and will give cluster wide permission to watch events across all namespaces but the kubectl command is incorrect.The command should be </p>

<pre><code>kubectl auth can-i watch events --as=system:serviceaccount:test:watch-events
</code></pre>
