<p>I can't figure out whats wrong with my role binding. I keep getting this error while trying to get metrics for my pod.</p>
<p><code>&quot;pods.metrics.k8s.io &quot;my-pod-name&quot; is forbidden: User &quot;system:serviceaccount:default:default&quot; cannot get resource &quot;pods&quot; in API group &quot;metrics.k8s.io&quot; in the namespace &quot;default&quot;&quot;</code></p>
<p>Here is the Cluster role yaml file</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-reader
rules:
  - apiGroups: [&quot;&quot;, &quot;metrics.k8s.io&quot;] # &quot;&quot; indicates the core API group
    resources: [&quot;pods&quot;]
    verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
</code></pre>
<p>Then I ran this command</p>
<pre><code>kubectl create clusterrolebinding pod-reader \
  --clusterrole=pod-reader  \
  --serviceaccount=default:default
</code></pre>

<p>ClusterRole &amp; ClusterRolebinding are non-namespaced resources.  So, remove the namespace line from your YAML file.</p>
<p>Alternatively, use Role &amp; RoleBinding if you want to scope to a namespace.</p>
