<p>I am working on the operator and using operator-sdk for operator development. I am doing pod exec for some business logic but it kept on failing with the following error:</p>
<pre><code>Failed to cleanup testst StatefulSet StatefulSet.Name : devst{&quot;Instance.Namespace&quot;: &quot;default&quot;, &quot;Instance.Name&quot;: &quot;testst-sample&quot;, &quot;error&quot;: &quot;pods \&quot;testst-0\&quot; is forbidden: User \&quot;system:serviceaccount:test-db:default\&quot; cannot create resource \&quot;pods/exec\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;&quot;}
</code></pre>
<p>Following is the definition role:</p>
<pre><code>Name:         manager-role
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;ClusterRole&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;creationTimestamp&quot;:null,&quot;name&quot;:&quot;manager-ro...
PolicyRule:
  Resources                                  Non-Resource URLs  Resource Names  Verbs
  ---------                                  -----------------  --------------  -----
  statefulsets.''/finalizers                 []                 []              [create delete get list patch update watch]
  configmaps                                 []                 []              [create delete get list patch update watch]
  persistentvolumeclaims                     []                 []              [create delete get list patch update watch]
  secrets                                    []                 []              [create delete get list patch update watch]
  services                                   []                 []              [create delete get list patch update watch]
  statefulsets.apps                          []                 []              [create delete get list patch update watch]
  teststapps.example.com                     []                 []              [create delete get list patch update watch]
  teststapps.example.com/finalizers          []                 []              [create delete get patch update]
  pods/exec                                  []                 []              [create get]
  pods/log                                   []                 []              [get list watch]
  pods                                       []                 []              [get list watch]
  teststapps.example.com/status              []                 []              [get patch update]
</code></pre>
<p>Role Binding Definition</p>
<pre><code>kubectl describe clusterrolebinding.rbac.authorization.k8s.io/manager-rolebinding
Name:         manager-rolebinding
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;ClusterRoleBinding&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;manager-rolebinding&quot;},&quot;roleR...
Role:
  Kind:  ClusterRole
  Name:  manager-role
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  default  system

</code></pre>
<p>Please advise what wrong I am doing.</p>

drifter
<p>As per the RoleBinding you have associated the ClusterRole <code>manager-role</code> to a <code>ServiceAccount</code> <code>default</code> in the <code>system</code> namespace but from the error the ServiceAccount is <code>default</code> in <code>test-db</code> namespace.</p>
<p>If you change the namespace <code>system</code> to <code>test-db</code> in the RoleBinding it should work. Also make sure to create the RoleBinding in <code>test-db</code> namespace instead of <code>system</code> namespace.</p>
