<p>I'm trying to create a read only user. I want the user to be able to list nodes and pods and view the dashboard. I got the certs created and can connect but I'm getting the following error.</p>

<pre><code>$ kubectl --context minikube-ro get pods --all-namespaces
Error from server (Forbidden): pods is forbidden: User "erst-operation" cannot list pods at the cluster scope
</code></pre>

<p>My cluster role...</p>

<pre><code>$ cat helm/namespace-core/templates/pod-reader-cluster-role.yaml 
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: '*'
  name: pod-reader
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
</code></pre>

<p>My cluster role binding...</p>

<pre><code>$ cat helm/namespace-core/templates/pod-reader-role-binding.yaml 
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
  - kind: User
    name: erst-operation
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>I'm aware the above shouldn't grant permissions to see the dashboard but how do I get it to just list the pods?</p>

<p>You cluster role should contain Core group as resource <code>pods</code> are in Core group.</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: '*'
  name: pod-reader
rules:
- apiGroups: ["extensions", "apps", ""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
</code></pre>
