<p>I can't get a rolebinding right in order to get node status from an app which runs in a pod on GKE.</p>
<p>I am able to create a pod from there but not get node status. Here is the role I am creating:</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: node-reader
rules:
- apiGroups: [&quot;&quot;] # &quot;&quot; indicates the core API group
  resources: [&quot;nodes&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
</code></pre>
<p>This is the error I get when I do a getNodeStatus:</p>
<pre><code>{
    &quot;kind&quot;: &quot;Status&quot;,
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;metadata&quot;: {},
    &quot;status&quot;: &quot;Failure&quot;,
    &quot;message&quot;: &quot;nodes \&quot;gke-cluster-1-default-pool-36c26e1e-2lkn\&quot; is forbidden: User \&quot;system:serviceaccount:default:sa-poc\&quot; cannot get nodes/status at the cluster scope: Unknown user \&quot;system:serviceaccount:default:sa-poc\&quot;&quot;,
    &quot;reason&quot;: &quot;Forbidden&quot;,
    &quot;details&quot;: {
        &quot;name&quot;: &quot;gke-cluster-1-default-pool-36c26e1e-2lkn&quot;,
        &quot;kind&quot;: &quot;nodes&quot;
    },
    &quot;code&quot;: 403
}
</code></pre>
<p>I tried with some minor variations but did not succeed.</p>
<p>Kubernetes version on GKE is 1.8.4-gke.</p>

<p>Subresource permissions are represented as <code>&lt;resource&gt;/&lt;subresource&gt;</code>, so in the role, you would specify <code>resources: ["nodes","nodes/status"]</code></p>
