<p><strong>Final update</strong>: Apparently there was some sort of issue with the variables defined in the <code>curl</code> command when redefined them after closing the connection to the cluster, command started working.</p>
<hr />
<p>The setup is simple, on learning environment.
i created <code>ServiceAccount</code>, <code>Role</code> &amp; <code>Rolebinding</code></p>
<p>Trying to query pods or Services, i'm getting:</p>
<pre><code>{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {},
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;services is forbidden: User \&quot;system:serviceaccount:default:myscript\&quot; cannot list resource \&quot;services\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;kind&quot;: &quot;services&quot;
  },
  &quot;code&quot;: 403
</code></pre>
<p>I don't know where i'm failing.
Originally i had only <code>get</code>, <code>list</code> and <code>delete</code> verbs. but even after using wildcard '*' keeps saying forbidden.</p>
<p>Here's some info from the cluster:</p>
<p><strong>Query command</strong>: <code>curl -X GET $SERVER/api/v1/namespaces/default/services --header &quot;Authorization: Bearer $MYSCRIPT_TOKEN&quot; --cacert /etc/kubernetes/pki/ca.crt</code></p>
<pre><code>ubuntu@master:~/$ kubectl describe sa myscript
Name:                myscript
Namespace:           default
Labels:              &lt;none&gt;
Annotations:         &lt;none&gt;
Image pull secrets:  &lt;none&gt;
Mountable secrets:   &lt;none&gt;
Tokens:              myscript-token
Events:              &lt;none&gt;

ubuntu@master:~/$ kubectl get role script-role
NAME          CREATED AT
script-role   2022-09-04T10:44:22Z

ubuntu@master:~/$ kubectl get rolebinding script-rb -o wide
NAME        ROLE               AGE   USERS   GROUPS   SERVICEACCOUNTS
script-rb   Role/script-role   57m                    default/myscript

ubuntu@master:~/$ kubectl describe role script-role
Name:         script-role
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources         Non-Resource URLs  Resource Names  Verbs
  ---------         -----------------  --------------  -----
  pods              []                 []              [*]
  services          []                 []              [*]
  deployments.apps  []                 []              [get list delete]
</code></pre>
<p><strong>Update:</strong></p>
<p>few <code>can-i</code> commands that evidence RBAC should be good.</p>
<pre><code>ubuntu@master:~$ kubectl auth can-i get services --as system:serviceaccount:default:myscript
yes
ubuntu@master:~$ kubectl auth can-i list services --as system:serviceaccount:default:myscript
yes
ubuntu@master:~$ kubectl auth can-i delete services --as system:serviceaccount:default:myscript
yes
ubuntu@master:~$ kubectl auth can-i delete deploy --as system:serviceaccount:default:myscript
yes
ubuntu@master:~$ kubectl auth can-i update  deploy --as system:serviceaccount:default:myscript
no
</code></pre>
<p><code>ServiceAccount</code> manifest.</p>
<pre><code>ubuntu@master:~$ kubectl get sa myscript -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2022-09-04T10:35:47Z&quot;
  name: myscript
  namespace: default
  resourceVersion: &quot;675592&quot;
  uid: ab3b3c20-e3b9-405a-a9e9-e4f65ac13f5c
</code></pre>
<p><code>Role</code> manifest</p>
<pre><code>ubuntu@master:~$ kubectl get role script-role -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;Role&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;script-role&quot;,&quot;namespace&quot;:&quot;default&quot;},&quot;rules&quot;:[{&quot;apiGroups&quot;:[&quot;&quot;],&quot;resources&quot;:[&quot;pods&quot;,&quot;services&quot;],&quot;verbs&quot;:[&quot;get&quot;,&quot;list&quot;,&quot;delete&quot;]},{&quot;apiGroups&quot;:[&quot;apps&quot;],&quot;resources&quot;:[&quot;deployments&quot;],&quot;verbs&quot;:[&quot;get&quot;,&quot;list&quot;,&quot;delete&quot;]}]}
  creationTimestamp: &quot;2022-09-04T10:44:22Z&quot;
  name: script-role
  namespace: default
  resourceVersion: &quot;681508&quot;
  uid: a1b03864-081e-4d0a-bf54-9c69f6f6c17e
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - pods
  - services
  verbs:
  - '*'
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - get
  - list
  - delete
</code></pre>
<p><code>RoleBinding</code> manifest</p>
<pre><code>ubuntu@master:~$ kubectl get rolebinding script-rb -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;RoleBinding&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;creationTimestamp&quot;:null,&quot;name&quot;:&quot;script-rb&quot;,&quot;namespace&quot;:&quot;default&quot;},&quot;roleRef&quot;:{&quot;apiGroup&quot;:&quot;rbac.authorization.k8s.io&quot;,&quot;kind&quot;:&quot;Role&quot;,&quot;name&quot;:&quot;script-role&quot;},&quot;subjects&quot;:[{&quot;kind&quot;:&quot;ServiceAccount&quot;,&quot;name&quot;:&quot;myscript&quot;,&quot;namespace&quot;:&quot;default&quot;}]}
  creationTimestamp: &quot;2022-09-04T10:46:05Z&quot;
  name: script-rb
  namespace: default
  resourceVersion: &quot;676627&quot;
  uid: dbdcef8f-6a30-4cd3-8152-2626c2284c83
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: script-role
subjects:
- kind: ServiceAccount
  name: myscript
  namespace: default
</code></pre>

Dichtrich
<p>2 questions:</p>
<ol>
<li>Can you share the manifests of <code>Role</code>, <code>RoleBinding</code> and <code>ServiceAccount</code>?</li>
<li>Are you able to verify the working of your <code>Role</code> &amp; <code>RoleBinding</code> with ServiceAccount using the <code>kubectl auth can-i</code> <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">command</a>?</li>
</ol>
<pre><code>// kubectl auth can-i &lt;verb&gt; &lt;resource&gt; -n &lt;namespace&gt; --as system:service:&lt;namespace&gt;:&lt;service-account-name&gt; 
kubectl auth can-i get service --as system:serviceaccount:default:myscript
</code></pre>
