<p>I created a service account and I want to give it permissions to list pods: <code>kubectl get pods</code>.  </p>

<p>I have these settings for service account, role and rolebinding:</p>

<p><strong>ServiceAccount.yaml</strong>:  </p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: myservice3
</code></pre>

<p><strong>Role.yaml</strong>:  </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  namespace: default
  name: my-role
rules: 
- apiGroups: ["", "extensions", "apps"]
  resources: ["pods"]
  verbs: ["get"] 
</code></pre>

<p><strong>RoleBinding.yaml</strong>: </p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  name: my-role-binding
  namespace: default
subjects: 
- kind: ServiceAccount 
  name: myservice3
  namespace: default
  apiGroup: ""
roleRef: 
  kind: Role
  name: my-role
  apiGroup: ""
</code></pre>

<p>I created a user with the token of the service account:  </p>

<pre><code>SECRET_NAME=`kubectl get serviceaccounts myservice3 -o json | jq -r '.secrets[].name'`
TOKEN=`kubectl get secrets $SECRET_NAME -o json | jq -r '.data | .token' | base64 -d`
kubectl config set-credentials $USER_NAME --token=$TOKEN
</code></pre>

<p>Set a context to this user:  </p>

<pre><code>kubectl config set-context my-context \
--cluster=kubernetes \
--namespace=default \
--user=$USER_NAME
</code></pre>

<p>When tried to use its permissions:  </p>

<pre><code>$ kubectl get pods --context=my-context
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:default:myservice3" cannot list pods in the namespace "default"
</code></pre>

<p>I also tried with <code>curl</code>:  </p>

<pre><code>$ curl -k -v -H "Authorization: Bearer $TOKEN" https://127.0.0.1:6443
* About to connect() to 127.0.0.1 port 6443 (#0)
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 6443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate not found (nickname not specified)
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=kube-apiserver
*       start date: Jul 02 09:36:21 2018 GMT
*       expire date: Jul 02 09:36:21 2019 GMT
*       common name: kube-apiserver
*       issuer: CN=kubernetes
&gt; GET / HTTP/1.1
&gt; User-Agent: curl/7.29.0
&gt; Host: 127.0.0.1:6443
&gt; Accept: */*
&gt; Authorization: Bearer &lt;JWT_token&gt;
&gt;
&lt; HTTP/1.1 403 Forbidden
&lt; Content-Type: application/json
&lt; X-Content-Type-Options: nosniff
&lt; Date: Mon, 02 Jul 2018 12:17:10 GMT
&lt; Content-Length: 257
&lt;
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:serviceaccount:default:myservice3\" cannot get path \"/\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
* Connection #0 to host 127.0.0.1 left intact
</code></pre>

<p>Any idea what I am doing wrong?  I gave the service account a <code>get pods</code> permissions and it is still being forbidden.  </p>

<p>The Role.yaml needed to have also <code>list</code>:  </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  namespace: default
  name: my-role
rules: 
- apiGroups: ["", "extensions", "apps"]
  resources: ["pods"]
  verbs: ["get", "list"] 
</code></pre>

<p><code>get</code> is a permission to get an individual item and <code>list</code> is permission to get all itmes.<br>
Now it works when run:  </p>

<pre><code>kubectl get pods --context=myservice3-context
</code></pre>

<p>OR  </p>

<pre><code>curl -k -v -H "Authorization: Bearer &lt;JWT_token&gt; " https://127.0.0.1:6443/api/v1/namespaces/default/pods
</code></pre>
