<p><code>Forbidden!Configured service account doesn't have access. Service account may have been revoked. User "system:serviceaccount:default:default" cannot get services in the namespace "mycomp-services-process"</code></p>

<p>For the above issue I have created "mycomp-service-process" namespace and checked the issue.</p>

<p>But it shows again message like this:</p>

<p><code>Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. User "system:serviceaccount:mycomp-services-process:default" cannot get services in the namespace "mycomp-services-process"</code></p>

<p>Creating a namespace won't, of course, solve the issue, as that is not the problem at all.</p>

<p>In the first error the issue is that <code>serviceaccount</code> default in default namespace <code>can not get services</code> because it does not have access to list/get services. So what you need to do is assign a role to that user using <code>clusterrolebinding</code>.</p>

<p>Following the set of minimum privileges, you can first create a role which has access to list services:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: service-reader
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["services"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>What above snippet does is create a clusterrole which can list, get and watch services. (You will have to create a yaml file and apply above specs)</p>

<p>Now we can use this clusterrole to create a clusterrolebinding:</p>

<pre><code>kubectl create clusterrolebinding service-reader-pod \
  --clusterrole=service-reader  \
  --serviceaccount=default:default
</code></pre>

<p>In above command the <code>service-reader-pod</code> is name of clusterrolebinding and it is assigning the service-reader clusterrole to default serviceaccount in default namespace. Similar steps can be followed for the second error you are facing.</p>

<p>In this case I created <code>clusterrole</code> and <code>clusterrolebinding</code> but you might want to create a <code>role</code> and <code>rolebinding</code> instead. You can check the <a href="https://kubernetes.io/docs/admin/authorization/rbac/" rel="noreferrer">documentation in detail here</a></p>
