<p>When I run a docker image using <strong>KubernetesPodOperator</strong> in Airflow version 1.10</p>
<p>Once the pod finishes the task successfullly, airflow tries to get the xcom value by making a connection to the pod via k8s stream client.</p>
<p>Following is the error which I encountered:</p>
<pre><code>[2018-12-18 05:29:02,209] {{models.py:1760}} ERROR - (0)
Reason: Handshake status 403 Forbidden
Traceback (most recent call last):
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/stream/ws_client.py&quot;, line 249, in websocket_call
    client = WSClient(configuration, get_websocket_url(url), headers)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/stream/ws_client.py&quot;, line 72, in __init__
    self.sock.connect(url, header=header)
  File &quot;/usr/local/lib/python3.6/site-packages/websocket/_core.py&quot;, line 223, in connect
    self.handshake_response = handshake(self.sock, *addrs, **options)
  File &quot;/usr/local/lib/python3.6/site-packages/websocket/_handshake.py&quot;, line 79, in handshake
    status, resp = _get_resp_headers(sock)
  File &quot;/usr/local/lib/python3.6/site-packages/websocket/_handshake.py&quot;, line 152, in _get_resp_headers
    raise WebSocketBadStatusException(&quot;Handshake status %d %s&quot;, status, status_message)
websocket._exceptions.WebSocketBadStatusException: Handshake status 403 Forbidden
</code></pre>
<blockquote>
<p>I'm using K8s service account for this</p>
</blockquote>
<p>DAG configs</p>
<blockquote>
<p>xcom=true,</p>
<p>get_logs=True,</p>
<p>in_cluster=true</p>
</blockquote>

<p>So we also hit this problem, we had to modify our rbac rules, in particular we had to add the resource "pods/exec" with the verbs "create" and "get"</p>

<pre><code>---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: airflow-runner
rules:
- apiGroups: [""]
  resources: ["deployments", "pods", "pods/log", "pods/exec", "persistentvolumeclaims"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["singleuser-image-credentials"]
  verbs: ["read","list","watch","create","get"]
</code></pre>
