<p><a href="https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod" rel="noreferrer">As per this Documentation</a>, I am trying to access the Kuberenetes API from a pod, using the following command</p>

<p><code>curl --cacert ca.crt -H "Authorization: Bearer $(&lt;token)" https://kubernetes/apis/extensions/v1beta1/namespaces/default/deployments/ballerina-prime/scale</code> </p>

<p>which follows the following template</p>

<p><code>curl --cacert ca.crt -H "Authorization: Bearer $(&lt;token)" https://kubernetes/apis/extensions/v1beta1/namespaces/{namespace}/deployments/{name}/scale</code> </p>

<p>It throws the following error</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "deployments.extensions \"ballerina-prime\" is forbidden: User \"system:serviceaccount:default:default\" cannot get resource \"deployments/scale\" in API group \"extensions\" in the namespace \"default\"",
  "reason": "Forbidden",
  "details": {
    "name": "ballerina-prime",
    "group": "extensions",
    "kind": "deployments"
  },
  "code": 403
}
</code></pre>

<p>Can someone point out where I am making mistake or suggest any other way in which I can access the Kubernetes API?</p>

<p><strong>Update 01</strong></p>

<p>I created a Role as per the Documentation suggested. Following is the manifest I used.</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: deployments-and-deployements-scale
rules:
- apiGroups: [""]
  resources: ["deployments", "deployments/scale"]
  verbs: ["get", "list"]
</code></pre>

<p>I applied it using this command. <code>kubectl apply -f deployments-and-deployements-scale.yaml</code>. Still I am unable to access the endpoint needed. Where am I making mistake?</p>

<p>First, you are connecting correctly to the kubernetes API!</p>

<p>But the default serviceaccount ("user") you are using does not have the required privileges to perform the operation, that you want to do. (Reading the deployment 'ballerina-prima' in the namespace 'default')</p>

<p>What you need to do: Use a different serviceaccount or grant the permissions that are required to the default service account.</p>

<p>You can find detailed information in the documentation: <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a></p>
