<p>I am new to kubernetes administration. While trying to list &amp; setup new cronjobs, one of the users is getting the following error: </p>

<blockquote>
  <p>Error from server (Forbidden): cronjobs.batch is forbidden: User
   cannot list cronjobs.batch in the namespace </p>
</blockquote>

<p>The role while creating this user:
</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: &lt;user&gt;
  name: &lt;user&gt;-role
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["*"]
  verbs: ["*"]
</code></pre>

<p>The role binding while creating this user:
</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: &lt;user&gt;-role-binding
  namespace: &lt;user&gt;
subjects:
- kind: User
  name: &lt;user&gt;
  apiGroup: ""
roleRef:
  kind: Role
  name: &lt;user&gt;-role
  apiGroup: ""
</code></pre>

<p>What could the issue possibly be?</p>

<p>The <code>Cronjob</code> resource belongs to the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#cronjob-v1beta1-batch" rel="nofollow noreferrer"><code>batch</code> API group</a>.  </p>

<p>In your RBAC role, you have only granted access to the <code>core</code> (empty name), <code>extensions</code> and <code>apps</code> API groups.</p>

<p>To enable your user to access CronJob objects, add the <code>batch</code> API group to your RBAC role:</p>

<pre class="lang-yaml prettyprint-override"><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: &lt;user&gt;
  name: &lt;user&gt;-role
rules:
- apiGroups: ["", "extensions", "apps", "batch"]
  resources: ["*"]
  verbs: ["*"]
</code></pre>
