<p>I trying to create a service account with permissions to get information about endpoints pod IPs and getting back a permissions problem.</p>
<p>Creating the service account and give it the right permissions:</p>
<pre><code>$ kubectl create role endpoints-reader --verb=get --verb=list --resource=endpoints
$ kubectl create serviceaccount endpoints-reader-sa
$ kubectl create rolebinding default-endpoints-reader --role=endpoints-reader --serviceaccount=endpoints-reader-sa:endpoints-reader-sa
</code></pre>
<p>Adding this sa to the deployment YAML file:</p>
<pre><code>...
spec:
  serviceAccountName: endpoints-reader-sa
  containers:
  - name: ...
</code></pre>
<p>I stated the pod and logged in into it (ssh). Now I want to run a REST call to pull the information:</p>
<pre><code>$ TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token);
$ curl https://kubernetes.default.svc/api/v1/namespaces/XXX/endpoints --silent --header &quot;Authorization: Bearer $TOKEN&quot; --insecure
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {

  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;endpoints is forbidden: User \&quot;system:serviceaccount:XXX:endpoints-reader-sa\&quot; cannot list resource \&quot;endpoints\&quot; in API group \&quot;\&quot; in the namespace \&quot;XXX\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;kind&quot;: &quot;endpoints&quot;
  },
  &quot;code&quot;: 403
}
</code></pre>
<p>What I'm doing wrong?</p>

<p>OK... Found the issue.</p>
<p>So, this line:</p>
<pre><code>kubectl create rolebinding default-endpoints-reader --role=endpoints-reader --serviceaccount=endpoints-reader-sa:endpoints-reader-sa
</code></pre>
<p>should be changed to this:</p>
<pre><code>kubectl create rolebinding default-endpoints-reader --role=endpoints-reader --serviceaccount=XXX:endpoints-reader-sa
</code></pre>
<p>Where <code>XXX</code> is the namespace name.
Similar problem you can find <a href="https://stackoverflow.com/questions/59384520/getting-403-error-while-trying-to-create-pods-using-custom-service-account">here</a>.</p>
