<p>I would like permit a Kubernetes pod in namespace <code>my-namespace</code> to access <code>configmap/config</code> in the same namespace. For this purpose I have defined the following <code>role</code> and <code>rolebinding</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: List
items:
- kind: Role
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: config
    namespace: my-namespace
  rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;configmaps&quot;]
    resourceNames: [&quot;config&quot;]
    verbs: [&quot;get&quot;] 
- kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: config
    namespace: my-namespace
  subjects:
  - kind: ServiceAccount
    name: default
    namespace: my-namespace
  roleRef:
    kind: Role
    name: config
    apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>Yet still, the pod runs into the following error:</p>
<pre class="lang-none prettyprint-override"><code>configmaps \&quot;config\&quot; is forbidden: User \&quot;system:serviceaccount:my-namespace:default\&quot; 
cannot get resource \&quot;configmaps\&quot; in API group \&quot;\&quot; in the namespace \&quot;my-namespace\&quot;
</code></pre>
<p>What am I missing? I guess it must be a simple thing, which a second pair of eyes may spot immediately.</p>
<p><strong>UPDATE</strong> Here is a relevant fragment of my client code, which uses <a href="https://github.com/kubernetes/client-go" rel="nofollow noreferrer">go-client</a>:</p>
<pre class="lang-go prettyprint-override"><code>cfg, err := rest.InClusterConfig()
if err != nil {
        logger.Fatalf(&quot;cannot obtain Kubernetes config: %v&quot;, err)
}
k8sClient, err := k8s.NewForConfig(cfg)
if err != nil {
        logger.Fatalf(&quot;cannot create Clientset&quot;)
}       
configMapClient := k8sClient.CoreV1().ConfigMaps(Namespace)

configMap, err := configMapClient.Get(ctx, &quot;config&quot;, metav1.GetOptions{})
if err != nil {
        logger.Fatalf(&quot;cannot obtain configmap: %v&quot;, err) // error occurs here
}
</code></pre>

rookie099
<p>I don't see anything in particular wrong with your Role or
Rolebinding, and in fact when I deploy them into my environment they
seem to work as intended. You haven't provided a complete reproducer in your question, so here's how I'm testing things out:</p>
<ul>
<li><p>I started by creating a namespace <code>my-namespace</code></p>
</li>
<li><p>I have the following in <code>kustomization.yaml</code>:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: my-namespace

commonLabels:
  app: rbactest

resources:
- rbac.yaml
- deployment.yaml

generatorOptions:
  disableNameSuffixHash: true

configMapGenerator:
  - name: config
    literals:
      - foo=bar
      - this=that
</code></pre>
</li>
<li><p>In <code>rbac.yaml</code> I have the Role and RoleBinding from your question (without modification).</p>
</li>
<li><p>In <code>deployment.yaml</code> I have:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: cli
spec:
  replicas: 1
  template:
    spec:
      containers:
        - name: cli
          image: quay.io/openshift/origin-cli
          command:
            - sleep
            - inf
</code></pre>
</li>
</ul>
<p>With this in place, I deploy everything by running:</p>
<pre><code>kubectl apply -k .
</code></pre>
<p>And then once the Pod is up and running, this works:</p>
<pre><code>$ kubectl exec -n my-namespace deploy/cli -- kubectl get cm config
NAME     DATA   AGE
config   2      3m50s
</code></pre>
<p>Attempts to access other ConfigMaps will not work, as expected:</p>
<pre><code>$ kubectl exec deploy/cli -- kubectl get cm foo
Error from server (Forbidden): configmaps &quot;foo&quot; is forbidden: User &quot;system:serviceaccount:my-namespace:default&quot; cannot get resource &quot;configmaps&quot; in API group &quot;&quot; in the namespace &quot;my-namespace&quot;
command terminated with exit code 1
</code></pre>
<p>If you're seeing different behavior, it would be interesting to figure out where your process differs from what I've done.</p>
<hr />
<p>Your Go code looks fine also; I'm able to run this in the &quot;cli&quot; container:</p>
<pre><code>package main

import (
    &quot;context&quot;
    &quot;fmt&quot;
    &quot;log&quot;

    metav1 &quot;k8s.io/apimachinery/pkg/apis/meta/v1&quot;
    &quot;k8s.io/client-go/kubernetes&quot;
    &quot;k8s.io/client-go/rest&quot;
)

func main() {
    config, err := rest.InClusterConfig()
    if err != nil {
        panic(err.Error())
    }
    clientset, err := kubernetes.NewForConfig(config)
    if err != nil {
        panic(err.Error())
    }

    namespace := &quot;my-namespace&quot;

    configMapClient := clientset.CoreV1().ConfigMaps(namespace)

    configMap, err := configMapClient.Get(context.TODO(), &quot;config&quot;, metav1.GetOptions{})
    if err != nil {
        log.Fatalf(&quot;cannot obtain configmap: %v&quot;, err)
    }

    fmt.Printf(&quot;%+v\n&quot;, configMap)
}
</code></pre>
<p>If I compile the above, <code>kubectl cp</code> it into the container and run it, I get as output:</p>
<pre><code>&amp;ConfigMap{ObjectMeta:{config  my-namespace  2ef6f031-7870-41f1-b091-49ab360b98da 2926 0 2022-10-15 03:22:34 +0000 UTC &lt;nil&gt; &lt;nil&gt; map[app:rbactest] map[kubectl.kubernetes.io/last-applied-configuration:{&quot;apiVersion&quot;:&quot;v1&quot;,&quot;data&quot;:{&quot;foo&quot;:&quot;bar&quot;,&quot;this&quot;:&quot;that&quot;},&quot;kind&quot;:&quot;ConfigMap&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;labels&quot;:{&quot;app&quot;:&quot;rbactest&quot;},&quot;name&quot;:&quot;config&quot;,&quot;namespace&quot;:&quot;my-namespace&quot;}}
] [] [] [{kubectl-client-side-apply Update v1 2022-10-15 03:22:34 +0000 UTC FieldsV1 {&quot;f:data&quot;:{&quot;.&quot;:{},&quot;f:foo&quot;:{},&quot;f:this&quot;:{}},&quot;f:metadata&quot;:{&quot;f:annotations&quot;:{&quot;.&quot;:{},&quot;f:kubectl.kubernetes.io/last-applied-configuration&quot;:{}},&quot;f:labels&quot;:{&quot;.&quot;:{},&quot;f:app&quot;:{}}}} }]},Data:map[string]string{foo: bar,this: that,},BinaryData:map[string][]byte{},Immutable:nil,}
</code></pre>
