<p>I am running on kubernetes job (job-1) from base pod. It works for basic use case. For second use case, I want trigger another kubernetes job(job-2) from already running job: job-1. While running job-2 I get service account error as given below:</p>
<pre><code>Error occurred while starting container for Prowler due to exception : Failure executing: POST at: https://172.20.0.1/apis/batch/v1/namespaces/my-namespace/jobs. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. jobs.batch is forbidden: User &quot;system:serviceaccount:my-namespace:default&quot; cannot create resource &quot;jobs&quot; in API group &quot;batch&quot; in the namespace &quot;my-namespace&quot;.
</code></pre>
<p>I have created service account with required permissions as given below:</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-sa-service-role-binding
subjects:
  - kind: ServiceAccount
    name: my-sa
    namespace: my-namespace
roleRef:
  kind: Role
  name: my-namespace
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-sa-service-role
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;secrets&quot;, &quot;pods&quot;]
    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
  - apiGroups: [&quot;batch&quot;, &quot;extensions&quot;]
    resources: [&quot;jobs&quot;]
    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
  - apiGroups: [&quot;&quot;]
    resources: [&quot;pods/log&quot;]
    verbs: [&quot;get&quot;, &quot;list&quot;]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
</code></pre>
<p>I am passing &quot;my-sa&quot; as service account name but still, it refers to default service account.</p>
<p>I am using fabric8io kubernetes client to trigger the job and below is my code:</p>
<pre><code>          final Job job = new JobBuilder()
            .withApiVersion(&quot;batch/v1&quot;)
            .withNewMetadata()
            .withName(&quot;demo&quot;)
            .withLabels(Collections.singletonMap(&quot;label1&quot;, &quot;maximum-length-of-63-characters&quot;))
            .withAnnotations(Collections.singletonMap(&quot;annotation1&quot;, &quot;some-annotation&quot;))
            .endMetadata()
            .withNewSpec().withParallelism(1)
            .withNewTemplate()
            .withNewSpec().withServiceAccount(&quot;my-sa&quot;)
            .addNewContainer()
            .withName(&quot;prowler&quot;)
            .withImage(&quot;demo-image&quot;)
            .withEnv(env)
            .endContainer()
            .withRestartPolicy(&quot;Never&quot;)
            .endSpec()
            .endTemplate()
            .endSpec()
            .build();
</code></pre>

Akash Shinde
<p>If you see the error message in detail, you'll find that your client is not using the service account you created (<em>my-sa</em>). Its using the <em>default</em> service account in the namespace instead:</p>
<pre><code>&quot;system:serviceaccount:my-namespace:default&quot; cannot create resource &quot;jobs&quot;
</code></pre>
<p>And it should be safe to assume, that the default service account will not be having the privileges to create jobs.</p>
<p>It should be worthwhile to look into the official documentation of <em>fabric8io</em>, to see how you can authenticate with a custom service-account. From what I could find in the docs, it should be mostly handled by mounting the secret, corresponding to the service-account into the pod, then configuring your application code or probably setting up an specific environment variable.</p>
