<p>According to <a href="https://github.com/spring-cloud/spring-cloud-kubernetes#service-account" rel="noreferrer">Spring Cloud Kubernetes</a> docs, in order to discover services/pods in RBAC enabled Kubernetes distros:</p>

<blockquote>
  <p>you need to make sure a pod that runs with spring-cloud-kubernetes has access to the Kubernetes API. For any service accounts you assign to a deployment/pod, you need to make sure it has the correct roles. For example, you can add <code>cluster-reader</code> permissions to your default service account depending on the project you’re in.</p>
</blockquote>

<p>What are <code>cluster-reader</code> permissions in order to discover services/pods?</p>

<p>Error I receiving is:</p>

<pre><code>io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://x.x.x.x/api/v1/namespaces/jx-staging/services. 
Message: Forbidden!Configured service account doesn't have access. 
Service account may have been revoked. services is forbidden: 
User "system:serviceaccount:jx-staging:default" cannot list services in the namespace "jx-staging"
</code></pre>

<p>Read <code>endpoints</code> and <code>services</code> seems to be a bare minimum for Spring Cloud Kubernetes to discover pods and services. </p>

<p>Example adds permissions to <code>default</code> service account in <code>default</code> namespace. </p>

<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-read-role
rules:
- apiGroups:
  - ""
  resources:
  - endpoints
  - pods
  - services
  - configmaps
  verbs:
  - get
  - list
  - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-read-rolebinding
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-read-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>
