<p>I am trying to call k8s api in one k8s pod. But hit the following permission issue:</p>
<pre><code>User &quot;system:serviceaccount:default:flink&quot; cannot list resource &quot;nodes&quot; in API group &quot;&quot; at the cluster scope.
</code></pre>
<p>In my yaml file, I already have specified the <code>Role</code> &amp; <code>RoleBinding</code>. What do I miss here?</p>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: flink
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: zeppelin-server-role
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;services&quot;, &quot;configmaps&quot;, &quot;deployments&quot;, &quot;nodes&quot;]
  verbs: [&quot;create&quot;, &quot;get&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;list&quot;, &quot;delete&quot;, &quot;watch&quot;]
- apiGroups: [&quot;rbac.authorization.k8s.io&quot;]
  resources: [&quot;roles&quot;, &quot;rolebindings&quot;]
  verbs: [&quot;bind&quot;, &quot;create&quot;, &quot;get&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;list&quot;, &quot;delete&quot;, &quot;watch&quot;]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: zeppelin-server-role-binding
  namespace: default
subjects:
- kind: ServiceAccount
  name: flink
roleRef:
  kind: ClusterRole
  name: zeppelin-server-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>You are deploying zeppelin-server on Kubernetes, right? Your yaml file with the service account looks good as I suppose, however to be sure that this works, you should follow the next steps:</p>
<ul>
<li><code>kubectl get clusterrole</code></li>
</ul>
<p>and you should get <code>zeppelin-server-role</code> role.</p>
<ul>
<li>check if your account '<strong>flink</strong>' has a binding to clusterrole &quot;zeppelin-server-role&quot;</li>
</ul>
<p><code>kubectl get clusterrole clusterrolebinding</code></p>
<p>if there is no, you can create it by the following command:</p>
<p><code>kubectl create clusterrolebinding zeppelin-server-role-binding --clusterrole=zeppelin-server-role --serviceaccount=default:flink</code></p>
<ul>
<li>finally, check if you really act as this account:</li>
</ul>
<p><code>kubectl get deploy flink-deploy -o yaml</code></p>
<p>if you can't see the settings &quot;serviceAccount&quot; and &quot;serviceAccountName&quot; from the output something like:</p>
<pre><code>...
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30
...
</code></pre>
<p>then add this account you want flink to use:</p>
<p><code>kubectl patch deploy flink-deploy -p '{&quot;spec&quot;:{&quot;template&quot;:{&quot;spec&quot;:{&quot;serviceAccount&quot;:&quot;tiller&quot;}}}}'</code></p>
