<p>I am trying to query <code>kubernetes secret</code> using APIs and  I provided required permission to account <code>&quot;default:default&quot;</code> using the following command</p>
<pre><code>kubectl create rolebinding default-viewer \
  --clusterrole=view \
  --serviceaccount=default:default \
  --namespace=default
</code></pre>
<p>I was able to query the pods under namespace &quot;default&quot; using the following command</p>
<pre><code>   curl -v -s https://10.xx.xx.xx:6443/api/v1/namespaces/default/pods --header &quot;Authorization: Bearer $TOKEN&quot; --cacert /tmp/ca.crt
</code></pre>
<p>However, when I try to get the <code>secrets</code> from namespace <code>&quot;default&quot;</code> it errored with the following</p>
<pre><code>curl -v -s https://10.xx.xx.xx:6443/api/v1/namespaces/default/secrets --header &quot;Authorization: Bearer $TOKEN&quot; --cacert /tmp/ca.crt
</code></pre>
<p><strong>ERROR</strong></p>
<pre><code> &quot;message&quot;: &quot;secrets is forbidden: User \&quot;system:serviceaccount:default:default\&quot; cannot list resource \&quot;secrets\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;&quot;,
</code></pre>
<p>I am not sure what am I missing here?  Any help</p>

Sathish Kumar
<p>You have provided access to Service account <code>default</code> of default namespace using cluster role <code>view</code>. It seems(at least in my cluster) like the cluster role <code>view</code> does not provide any permissions related to secret.</p>
<pre><code>  kubectl describe  clusterrole view |grep -iEw 'secret|pods'
  pods/log                                     []                 []              [get list watch]
  pods/status                                  []                 []              [get list watch]
  pods                                         []                 []              [get list watch]
</code></pre>
<p>If you run the above command and the output of above command is same, then this explain why you can query <code>pods</code> not <code>secrets</code>. Below command print the cluster roles having string &quot;secret&quot; in it.</p>
<pre><code>kubectl get clusterrole -o name |while read cr; do k describe $cr |grep -q secret &amp;&amp; echo &quot;$cr is having secret&quot;; done
clusterrole.rbac.authorization.k8s.io/admin is having secret
clusterrole.rbac.authorization.k8s.io/edit is having secret
clusterrole.rbac.authorization.k8s.io/system:aggregate-to-edit is having secret
clusterrole.rbac.authorization.k8s.io/system:controller:expand-controller is having secret
clusterrole.rbac.authorization.k8s.io/system:controller:persistent-volume-binder is having secret
clusterrole.rbac.authorization.k8s.io/system:kube-controller-manager is having secret
clusterrole.rbac.authorization.k8s.io/system:node is having secret
</code></pre>
<p>You may need to create a new clusterrole/role or modify the existing clusterrole/role.</p>
<p><strong>Additionally,</strong> You can run the kubectl with <code>--raw</code> to validate your API query/URI. This will remove Certificates, keys, cacert and tokens out of the equation. Eg:</p>
<pre><code>kubectl get --raw  https://10.xx.xx.xx:6443/api/v1/namespaces/default/secrets --as system:serviceaccount:default:default
</code></pre>
