<p>I have a service account <code>monitoring:prometheus-operator-operator</code> with a clusterrolebinding to to this clusterrole:</p>

<pre><code>Name:         prometheus-operator-operator
Labels:       app=prometheus-operator-operator
              chart=prometheus-operator-5.7.0
              heritage=Tiller
              release=prometheus-operator
Annotations:  &lt;none&gt;
PolicyRule:
  Resources                                       Non-Resource URLs  Resource Names  Verbs
  ---------                                       -----------------  --------------  -----
  configmaps                                      []                 []              [*]
  secrets                                         []                 []              [*]
  customresourcedefinitions.apiextensions.k8s.io  []                 []              [*]
  statefulsets.apps                               []                 []              [*]
  alertmanagers.monitoring.coreos.com/finalizers  []                 []              [*]
  alertmanagers.monitoring.coreos.com             []                 []              [*]
  prometheuses.monitoring.coreos.com/finalizers   []                 []              [*]
  prometheuses.monitoring.coreos.com              []                 []              [*]
  prometheusrules.monitoring.coreos.com           []                 []              [*]
  servicemonitors.monitoring.coreos.com           []                 []              [*]
  endpoints                                       []                 []              [get create update]
  services                                        []                 []              [get create update]
  namespaces                                      []                 []              [get list watch]
  pods                                            []                 []              [list delete]
  nodes                                           []                 []              [list watch]
</code></pre>

<p>Now, I am attempting to run this </p>

<pre><code>curl -ik -X DELETE \
  -H "Authorization: Bearer &lt;SERVICE_ACCOUNT_TOKEN&gt;" \
  https://kubernetes.default.svc/apis/monitoring.coreos.com/v1/monitoring/prometheusrules/zalenium
</code></pre>

<p>from <strong>within</strong> a pod in the cluster to delete a <code>PrometheusRule</code>.</p>

<p>My request however is not successful and being rejected with a 403:</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "monitoring.monitoring.coreos.com \"prometheusrules\" is forbidden: User \"system:serviceaccount:monitoring:prometheus-operator-operator\" cannot delete resource \"monitoring/zalenium\" in API group \"monitoring.coreos.com\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "name": "prometheusrules",
    "group": "monitoring.coreos.com",
    "kind": "monitoring"
  },
  "code": 403
}
</code></pre>

<p>Am I wrong believing that the service account in my <code>monitoring</code> namespace should be able to delete <code>PrometheusRule</code> on the cluster level?</p>

<p>To me everything looks correct and I don't understand why I get a <code>Forbidden</code> response.</p>

<p>you forgot to put namespace in the URI</p>

<pre><code>
curl -ik -X DELETE \
  -H "Authorization: Bearer &lt;SERVICE_ACCOUNT_TOKEN&gt;" \
  https://kubernetes.default.svc/apis/monitoring.coreos.com/v1/namespaces/monitoring/prometheusrules/zalenium

</code></pre>

<p>with the following command you can verify the if you are allowed to take action X with the resoucres Y</p>

<p><code>kubectl auth can-i delete prometheusrules --as system:serviceaccount:monitoring:prometheus-operator-operator -n monitoring</code></p>

<p>With the <strong>-v flag</strong> you can increase the verbosity of the request which also provides a request in curl form.  </p>
