<p>I am using <code>kops</code> in AWS to create my Kubernetes cluster.</p>

<p>I have created a cluster with RBAC enabled via <code>--authorization=RBAC</code> as described <a href="https://github.com/kubernetes/kops/blob/master/docs/cli/kops_create_cluster.md" rel="nofollow noreferrer">here.</a></p>

<p>I am trying to use the default service account token to interact with the cluster and getting this error:</p>

<p><code>Error from server (Forbidden): User "system:serviceaccount:default:default" cannot list pods in the namespace "default". (get pods)</code></p>

<p>Am I missing a role or binding somewhere?</p>

<p>I thing it <strong>is not a good idea</strong> to <strong>give the cluster-admin role to default service account in default namespace</strong>.</p>

<p>If you will give cluster-admin access to default user in default namespace - <strong>every app (pod)</strong> that will be deployed in cluster, in default namespace - <strong>will be able</strong> to manipulate the cluster <strong>(delete system pods/deployments or make other bad stuff)</strong>. </p>

<p>By default the clusterrole cluster-admin is given to default service account in kube-system namespace.
You can use it for interacting with cluster.</p>
