<p>I have a script that creates users with specific access.</p>
<p>the script runs the following commands:</p>
<pre><code>kubectl create serviceaccount username
kubectl create clusterrole readonlyuser --non-resource-url=* --verb=get,list,watch --resource=pods,pods/attach,pods/exec,pods/port-forward,pods/proxy,services/proxy
kubectl create clusterrolebinding username --serviceaccount=default:username --clusterrole=readonlyuser
kubectl create rolebinding username --serviceaccount=default:username --clusterrole=readonlyuser --namespace=namespace
</code></pre>
<p>When I try to exec into a pod in that specific namespace I get the following:</p>
<pre><code>Error from server (Forbidden): pods &quot;&lt;podname&gt;&quot; is forbidden: User &quot;system:serviceaccount:default:username&quot; cannot create resource &quot;pods/exec&quot; in API group &quot;&quot; in the namespace &quot;namespace&quot;
</code></pre>
<p>Any idea how to fix this?</p>

<p>The error message state the following:</p>
<pre><code> cannot create resource &quot;pods/exec&quot; in API group &quot;&quot; in the namespace &quot;namespace&quot;
</code></pre>
<p>So created another clusterrole and rolebinding as follow:</p>
<pre><code>kubectl create clusterrole exec-readonlyuser --verb create --resource pods/exec
kubectl create rolebinding exec-readonlyuser --clusterrole=exec-readonlyuser --serviceaccount default:namespace -n namespace
</code></pre>
<p>now tried to exec and it is working.</p>
<pre><code> kubectl exec -it nginx --as system:serviceaccount:namespace:username -- sh
 #
 #exit
</code></pre>
<p>If you are using <code>yaml</code> then this could be added as another rule in same clusterrole.</p>
