<p>I'm trying to give my service account <code>foo</code> permissions to get a list of the nodes on the cluster (via <code>kubectl get nodes</code>). I created a clusterrole and a role binding with these permissions:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
 name: foo-cluster-role
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
</code></pre>

<p>When I run a pod with that service account I'm unable to run <code>kubectl get nodes</code>: </p>

<pre><code>root@debugger:/# kubectl get nodes
Error from server (Forbidden): nodes is forbidden: User "system:serviceaccount:default:foo" cannot list resource "nodes" in API group "" at the cluster scope

</code></pre>

<p>Weirdly, when I ask via <code>kubectl auth can-i</code>, it tells me I should have access:</p>

<pre><code>root@debugger:/# kubectl auth can-i get nodes
Warning: resource 'nodes' is not namespace scoped
yes
</code></pre>

<p>How do I set up my serviceaccount so I have access to list the nodes on the cluster?</p>

<p><em>edit</em> clusterrolebinding looks like this:</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: foo-binding
subjects:
- kind: ServiceAccount
  name: foo
roleRef:
  kind: ClusterRole
  name: foo-cluster-role
  apiGroup: ""
</code></pre>

<p>You have to create <code>ClusterRoleBinding</code>. Please check with following.</p>
<pre><code>    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: foo-cluster-role
    rules:
    - apiGroups: [&quot;&quot;]
      resources: [&quot;nodes&quot;]
      verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: foo-binding
    subjects:
    - kind: ServiceAccount
      name: foo
      namespace: default
    roleRef:
      kind: ClusterRole
      name: foo-cluster-role
      apiGroup: rbac.authorization.k8s.io
</code></pre>
