<p>Config config = new ConfigBuilder().withMasterUrl(&quot;https://c2.eu-de.containers.cloud.ibm.com:78945&quot;).build();
try (KubernetesClient client = new DefaultKubernetesClient(config)) {</p>
<pre><code>        client.pods().inNamespace(&quot;default&quot;).list().getItems().forEach(
                pod -&gt; System.out.println(pod.getMetadata().getName())
        );

    } catch (KubernetesClientException ex) {
        // Handle exception
        ex.printStackTrace();
    }
</code></pre>
<p>I am getting io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: <a href="https://c2.eu-de.containers.cloud.ibm.com:78945/api/v1/namespaces" rel="nofollow noreferrer">https://c2.eu-de.containers.cloud.ibm.com:78945/api/v1/namespaces</a>. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. namespaces is forbidden: User &quot;system:serviceaccount:badefault&quot; cannot list resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope. this errror</p>

<p>From your error looks like your <code>ServiceAccount</code> doesn't have the required access to perform that specific operation. You've posted code for listing <code>Pod</code> objects but your error is complaining about listing <code>Namespace</code> objects.</p>
<pre><code>User &quot;system:serviceaccount:badefault&quot; cannot list resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope
</code></pre>
<p>You can provide Cluster Admin access to your <code>ServiceAccount</code> with this command:</p>
<pre><code>kubectl create clusterrolebinding default-pod --clusterrole cluster-admin --serviceaccount=&lt;namespace&gt;:badefault
</code></pre>
<p>If you don't want to give it Cluster Admin access, you can define Custom ClusterRole to restrict which apiGroups and resources you want your <code>ServiceAccount</code> to access:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: badefault-cluster-role
rules:
- apiGroups:
  - &quot;&quot; 
  resources: 
  - pods
  - namespaces
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
</code></pre>
<p>You can then define a <code>ClusterRoleBinding</code> to bind this <code>ClusterRole</code> to your <code>ServiceAccount</code> object:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: badefault-cluster-role-binding
subjects:
  - kind: ServiceAccount
    name: badefault
    namespace: default
roleRef:
  kind: ClusterRole
  name: badefault-cluster-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>With this your <code>ServiceAccount</code> should be able to access <code>pods</code> and <code>namespace</code> objects at Cluster Scope.</p>
