<p>I'm deploying an application to my Kubernetes cluster that uses the Kubernetes API to list the pods in the cluster (not only the ones in its namespace). The application will live in its own namespace.</p>

<p>The RBAC rules are as follows;</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: kubecontrol-rbac-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: kubecontrol-rbac-role-binding
  namespace: kubecontrol
subjects:
  - kind: ServiceAccount
    namespace: kubecontrol
    name: default
roleRef:
  kind: ClusterRole
  name: kubecontrol-rbac-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>As you can see I have a ClusterRole, that grants "list", "get" and "watch" permissions on the "pods" resource, and a RoleBinding that applies this ClusterRole to the <code>default</code> ServiceAccount for the namespace.</p>

<p>When I check the authorisation with <code>kubectl auth can-in</code>, this configuration would <em>appear</em> to be correct;</p>

<pre><code>$ kubectl -n kubecontrol auth can-i --as=system:serviceaccount:kubecontrol:default list pods
yes
</code></pre>

<pre><code>$ kubectl -n kubecontrol auth can-i --as=system:serviceaccount:kubecontrol:default list pods --v=8
...
I0326 23:17:05.125188   56505 request.go:947] Response Body: {"kind":"SelfSubjectAccessReview","apiVersion":"authorization.k8s.io/v1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kubecontrol","verb":"list","resource":"pods"}},"status":{"allowed":true,"reason":"RBAC: allowed by RoleBinding \"kubecontrol-rbac-role-binding/kubecontrol\" of ClusterRole \"kubecontrol-rbac-role\" to ServiceAccount \"default/kubecontrol\""}}
</code></pre>

<blockquote>
  <p><strong>RBAC: allowed by RoleBinding "kubecontrol-rbac-role-binding/kubecontrol" of ClusterRole "kubecontrol-rbac-role" to ServiceAccount "default/kubecontrol"</strong></p>
</blockquote>

<p>However, when I actually try to perform the operation, I get told I'm not allowed to do so;</p>

<pre><code>$ kubectl get pod --as=system:serviceaccount:kubecontrol:default --all-namespaces
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:kubecontrol:default" cannot list resource "pods" in API group "" at the cluster scope
</code></pre>

<p>I see the same error message in my application.</p>

<p>The user (<code>system:serviceaccount:kubecontrol:default</code>) is identical in both scenarios, so why am I not able to <em>list pods</em> even though according to Kubernetes itself I should be able to? Is there something I'm missing?</p>

<p>With <code>--all-namespaces</code> you list the pods in all namespaces of the cluster. But since you used only <code>RoleBinding</code>, you have the rights from the <code>ClusterRole</code> only for given namespace (in your case namespace <code>kubecontrol</code>). You have to use <code>ClusterRoleBinding</code> instead to give you the <code>ClusterRole</code> for the whole cluster.</p>
