<p>I'm trying to understand why on one cluster an operation is permitted but on the other i'm getting the following</p>
<pre><code>Exception encountered setting up namespace watch from Kubernetes API v1 endpoint https://10.100.0.1:443/api: namespaces is forbidden: User \&quot;system:serviceaccount:kube-system:default\&quot; cannot list resource \&quot;namespaces\&quot; in API group \&quot;\&quot; at the cluster scope ({\&quot;kind\&quot;:\&quot;Status\&quot;,\&quot;apiVersion\&quot;:\&quot;v1\&quot;,\&quot;metadata\&quot;:{},\&quot;status\&quot;:\&quot;Failure\&quot;,\&quot;message\&quot;:\&quot;namespaces is forbidden: User \\\&quot;system:serviceaccount:kube-system:default\\\&quot; cannot list resource \\\&quot;namespaces\\\&quot; in API group \\\&quot;\\\&quot; at the cluster scope\&quot;,\&quot;reason\&quot;:\&quot;Forbidden\&quot;,\&quot;details\&quot;:{\&quot;kind\&quot;:\&quot;namespaces\&quot;},\&quot;code\&quot;:403}\n)&quot;
</code></pre>
<p>I'm managing two Kubernetes clusters -</p>
<p><code>clusterA</code> booted with Kops version <code>v1.14.8</code></p>
<p><code>clusterB</code> booted on AWS EKS version <code>v1.14.9-eks-f459c0</code></p>
<p>So i've tried using the <code>kubectl auth</code> command to try figuring out and I do see that on one i'm allowed however on the second i'm not as you can see:</p>
<pre><code>kubectl config use-context clusterA
Switched to context &quot;clusterA&quot;.
kubectl auth can-i list pods --as=system:serviceaccount:kube-system:default -n kube-system
yes
kubectl config use-context clusterB
Switched to context &quot;clusterB&quot;.
kubectl auth can-i list pods --as=system:serviceaccount:kube-system:default -n kube-system
no
</code></pre>
<p>Is there a way to understand what are these two decisions based on <code>yes/no</code>?
Thanks for helping out!</p>

Antonio Gomez Alvarado
<p>The decision <code>yes/no</code> is based on whether there is a <code>clusterrole</code> and a <code>clusterrolebinding</code> or <code>rolebinding</code> which permits the <code>default</code> serviceaccount in <code>kube-system</code> namespace  to perform verb <code>list</code> on resource <code>namespace</code>.</p>
<p>The trick in case of <code>namespace</code> resource is that there needs to be a <code>clusterrole</code> instead of <code>role</code> because <code>namespace</code> is a cluster scoped resource.</p>
<p>You check what are the <code>clusterrole</code>,<code>role</code>, <code>clusterrolebinding</code>,<code>rolebinding</code> exists in a kubernetes cluster using below command</p>
<pre><code>kubectl get clusterrole,clusterrolebinding
kubectl get role,rolebinding -n namespacename
</code></pre>
<p>For more details refer Kubernetes RBAC <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">here</a></p>
