<p>I am using Kubernetes 1.8.6 on Google Kubernetes Engine and have a pod running Alpine as part of a <code>StatefulSet</code>.</p>

<p>I have logged into my pod using <code>kubectl exec -it my-pod-0 -- /bin/sh</code> and then run the following commands at the prompt:</p>

<pre><code>$ CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
$ TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
$ NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
$ curl --cacert $CA_CERT -H "Authorization: Bearer $TOKEN" "https://kubernetes
/api/v1/namespaces/$NAMESPACE/services/"
</code></pre>

<p>Unfortunately a 403 Forbidden error is returned:</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "services is forbidden: User \"system:serviceaccount:default:default\" cannot list services in the namespace \"default\": Unknown user \"system:serviceaccount:default:default\"",
  "reason": "Forbidden",
  "details": {
    "kind": "services"
  },
  "code": 403
</code></pre>

<p>What am I doing wrong?</p>

<p>You're not doing anything wrong. That pod's service account (specified in the pod's serviceAccountName) simply doesn't have any API permissions. </p>

<p>You can grant a view role to that service account like this:</p>

<pre><code>kubectl create rolebinding default-viewer \
  --clusterrole=view \
  --serviceaccount=default:default \
  --namespace=default
</code></pre>

<p>See <a href="https://kubernetes.io/docs/admin/authorization/rbac/#service-account-permissions" rel="noreferrer">https://kubernetes.io/docs/admin/authorization/rbac/#service-account-permissions</a> for more details about granting permissions to service accounts. </p>
