<p>I have a Kubernetes 1.10 cluster up and running. Using the following command, I create a container running bash inside the cluster:</p>

<pre><code>kubectl run tmp-shell --rm -i --tty --image centos -- /bin/bash
</code></pre>

<p>I download the correct version of kubectl inside the running container, make it executable and try to run</p>

<pre><code>./kubectl get pods
</code></pre>

<p>but get the following error:</p>

<pre><code>Error from server (Forbidden): pods is forbidden:
User "system:serviceaccount:default:default" cannot
list pods in the namespace "default"
</code></pre>

<p>Does this mean, that kubectl detected it is running inside a cluster and is automatically connecting to that one? How do I allow the serviceaccount to list the pods? My final goal will be to run <code>helm</code> inside the container. According to the docs I found, this should work fine as soon as <code>kubectl</code> is working fine.</p>

<blockquote>
  <p>Does this mean, that kubectl detected it is running inside a cluster and is automatically connecting to that one?</p>
</blockquote>

<p>Yes, it used the KUBERNETES_SERVICE_PORT and KUBERNETES_SERVICE_HOST envvars to locate the API server, and the credential in the auto-injected <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code> file to authenticate itself.</p>

<blockquote>
  <p>How do I allow the serviceaccount to list the pods?</p>
</blockquote>

<p>That depends on the authorization mode you are using. If you are using RBAC (which is typical), you can grant permissions to that service account by creating RoleBinding or ClusterRoleBinding objects.</p>

<p>See <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions</a> for more information.</p>

<p>I believe helm requires extensive permissions (essentially superuser on the cluster). The first step would be to determine what service account helm was running with (check the <code>serviceAccountName</code> in the helm pods). Then, to grant superuser permissions to that service account, run: </p>

<pre><code>kubectl create clusterrolebinding helm-superuser \
  --clusterrole=cluster-admin \
  --serviceaccount=$SERVICEACCOUNT_NAMESPACE:$SERVICEACCOUNT_NAME
</code></pre>
