<p>I am trying to run <code>helm status --tiller-namespace=$NAMESPACE $RELEASE_NAME</code> from a container inside that namespace.</p>

<p>I have a role with the rule</p>

<pre class="lang-yaml prettyprint-override"><code>  - apiGroups:
      - ""
    resources:
      - pods
      - configmaps
    verbs:
      - get
      - watch
</code></pre>

<p>bound to the default service account. But I was getting the error</p>

<blockquote>
  <p>Error: pods is forbidden: User "system:serviceaccount:mynamespace:default" cannot list resource "pods" in API group "" in the namespace "mynamespace"</p>
</blockquote>

<p>So I added the <code>list</code> verb like so</p>

<pre class="lang-yaml prettyprint-override"><code>  - apiGroups:
      - ""
    resources:
      - pods
      - configmaps
    verbs:
      - get
      - watch
      - list
</code></pre>

<p>and now I have progressed to the error <code>cannot create resource "pods/portforward" in API group ""</code>. I couldn't find anything in the k8s docs on how to assign different verbs to different resources in the same apiGroup but based on <a href="https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml" rel="nofollow noreferrer">this example</a> I assumed this should work:</p>

<pre class="lang-yaml prettyprint-override"><code>  - apiGroups:
      - ""
    resources:
      - pods
      - configmaps
    verbs:
      - get
      - watch
      - list
  - apiGroups:
      - ""
    resources:
      - pods/portforward
    verbs:
      - create
</code></pre>

<p>however, now I get the error <code>cannot get resource "configmaps" in API group ""</code>. Note I am running a <code>kubectl get cm $CMNAME</code> <em>before</em> I run the <code>helm status</code> command. </p>

<p>So it seems that I did have permission to do a <code>kubectl get cm</code> <em>until</em> I tried to add the permission to create a pods/portforward. </p>

<p>Can anyone explain this to me please?</p>

<p>also the cluster is running k8s version</p>

<pre><code>Server Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.7+1.2.3.el7", GitCommit:"cfc2012a27408ac61c8883084204d10b31fe020c", GitTreeState:"archive", BuildDate:"2019-05-23T20:00:05Z", GoVersion:"go1.10.8", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>and helm version</p>

<pre><code>Server: &amp;version.Version{SemVer:"v2.12.1", GitCommit:"02a47c7249b1fc6d8fd3b94e6b4babf9d818144e", GitTreeState:"clean"}
</code></pre>

Dan
<p>My issue was that I was deploying the manifests with these Roles as part of a helm chart (using helm 2). However, the service account for the tiller doing the deploying did not have the <code>create</code> <code>pods/portforward</code> permission. Thus it was unable to grant that permission and so it errored when trying to deploy the manifest with the Roles. This meant that the configmap get permission Role wasn't created hence the weird error.</p>
