<p>I create a service account, a role, and a role binding that attaches the role to the SA.</p>
<p>I am trying to get the service account to list nodes but I can't, although the auth call tells me I can (for deployments it's even worst, the role do allow it, but I can't do anything):</p>
<pre><code>#pods
Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test auth can-i get pods
yes
Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test get pods
NAME      READY   STATUS                       RESTARTS   AGE
no-st-1   0/1     CreateContainerConfigError   0          74m &lt;&lt;--ignore the ConfigError, this is expected.

# nodes 
Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test auth can-i get nodes
Warning: resource 'nodes' is not namespace scoped
yes       &lt;&lt;&lt;&lt;------ ?? i can get nodes, but then i can't??
Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test get nodes
Error from server (Forbidden): nodes is forbidden: User &quot;system:serviceaccount:psp-ns:sa-test&quot; cannot list resource &quot;nodes&quot; in API group &quot;&quot; at the cluster scope

#deployments (at least this one is consistent, although the role should allow this)
Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test auth can-i get deployments
no
Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test get deployments
Error from server (Forbidden): deployments.apps is forbidden: User &quot;system:serviceaccount:psp-ns:sa-test&quot; cannot list resource &quot;deployments&quot; in API group &quot;apps&quot; in the namespace &quot;psp-ns&quot;
</code></pre>
<p>The role I am using should allow all 3 operations above:</p>
<pre><code>Simons-MBP:psp simon$ kubectl describe role test-sa-role
Name:         test-sa-role
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;Role&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;test-sa-role&quot;,&quot;namespace&quot;:&quot;psp-ns&quot;},&quot;rules...
PolicyRule:
  Resources    Non-Resource URLs  Resource Names  Verbs
  ---------    -----------------  --------------  -----
  deployments  []                 []              [list get]
  nodes        []                 []              [list get]
  pods         []                 []              [list get]
</code></pre>
<p>And finally the role binding showing that the role is attached to this service account:</p>
<pre><code>Simons-MBP:psp simon$ kubectl describe rolebinding rb-test
Name:         rb-test
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;RoleBinding&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;rb-test&quot;,&quot;namespace&quot;:&quot;psp-ns&quot;},&quot;rol...
Role:
  Kind:  Role
  Name:  test-sa-role
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  sa-test  psp-ns
</code></pre>
<p>Why is this happening? I was expecting to be able to get all nodes/pods/deployments, and that <code>auth can-i</code> returns <code>yes</code> for all calls I tried.</p>

<pre><code>Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test auth can-i get nodes
</code></pre>
<p>Above command just checks what is the <code>ClusterRole</code>, <code>Role</code> and <code>RoleBinding</code> defined and since you have a <code>Role</code> which gives access to node it returns <code>yes</code>. It does not really consider the fact that <code>node</code> is a cluster coped resource and hence there should be a <code>ClusterRole</code> instead of <code>Role</code>.</p>
<p>Coming to why you are not able to access deployment it's because you might have <code>apiGroups: [&quot;&quot;]</code> in the role but deployments are in <code>apps</code> API group. Also use the namespace <code>psp-ns</code> explicitly in the command</p>
<pre><code>Simons-MBP:psp simon$ kubectl  --as=system:serviceaccount:psp-ns:sa-test auth can-i get deployments -n psp-ns
</code></pre>
<p>To be able to access <code>node</code> you need a <code>ClusterRole</code> instead of <code>Role</code> because <code>node</code> is a cluster coped resource.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # &quot;namespace&quot; omitted since ClusterRoles are not namespaced
  name: node-clusterrole
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;nodes&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: psp-ns
  name: deployment-role
- apiGroups: [&quot;apps&quot;]
  resources: [&quot;deployments&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
</code></pre>
<p>And then</p>
<ol>
<li>Create a <code>RoleBinding</code> or a <code>ClusterRoleBinding</code> to bind above ClusterRole <code>node-clusterrole</code> to the service account.</li>
<li>Create a <code>RoleBinding</code> to bind above Role <code>deployment-role</code> to the service account</li>
</ol>
