<p>I have a service account in kubernetes:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: testsa
  namespace: project-1
</code></pre>
<p>And I've assigned it the <code>view</code> role:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: testsa-view
  namespace: project-1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- kind: ServiceAccount
  name: testsa
  namespace: project-1
</code></pre>
<p>This should grant the service account read access to all resources. Inside a pod in the <code>project-1</code> namespace I am trying to run the following Python code:</p>
<pre><code>&gt;&gt;&gt; from kubernetes import client, config
&gt;&gt;&gt; config.load_incluster_config()
&gt;&gt;&gt; api = client.CoreV1Api()
&gt;&gt;&gt; api.list_pod_for_all_namespaces()
</code></pre>
<p>But this fails with a <code>403</code> error:</p>
<pre><code>kubernetes.client.rest.ApiException: (403)
Reason: Forbidden
[...]
HTTP response body: {&quot;kind&quot;:&quot;Status&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{},&quot;status&quot;:&quot;Failure&quot;,&quot;message&quot;:&quot;pods is forbidden: User \&quot;system:serviceaccount:project-1:testsa\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; at the cluster scope&quot;,&quot;reason&quot;:&quot;Forbidden&quot;,&quot;details&quot;:{&quot;kind&quot;:&quot;pods&quot;},&quot;code&quot;:403}
</code></pre>
<p>The pod is associated with the service account:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  labels:
    run: testsa
  name: testsa-2-l929g
  namespace: project-1
spec:
  serviceAccountName: testsa
  automountServiceAccountToken: true
  containers:
  - image: larsks/testsa
    imagePullPolicy: Always
    name: testsa
    ports:
    - containerPort: 8080
      protocol: TCP
    resources: {}
</code></pre>
<p>And inside the container, I can see the mounted secrets:</p>
<pre><code>/src $ find /run/secrets/ -type f
/run/secrets/kubernetes.io/serviceaccount/..2020_09_04_16_30_26.292719465/ca.crt
/run/secrets/kubernetes.io/serviceaccount/..2020_09_04_16_30_26.292719465/token
/run/secrets/kubernetes.io/serviceaccount/..2020_09_04_16_30_26.292719465/service-ca.crt
/run/secrets/kubernetes.io/serviceaccount/..2020_09_04_16_30_26.292719465/namespace
/run/secrets/rhsm/ca/redhat-uep.pem
/run/secrets/rhsm/ca/redhat-entitlement-authority.pem
</code></pre>
<p>What am I missing here?</p>

larsks
<p>The error says <code>cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; at the cluster scope</code> because you are trying to access all pods of all namespaces across the cluster instead of all pods of only <code>project-1</code> namespace.</p>
<p>So change the <code>Role</code> to a <code>ClusterRoleBinding</code></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: testsa-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- kind: ServiceAccount
  name: testsa
  namespace: project-1
</code></pre>
<p>Referring from the examples <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#kubectl-create-rolebinding" rel="nofollow noreferrer">here</a> <code>RoleBinding</code> always gives permission to namespace scoped resources limited to only that specific namespace even if you are referring to a <code>ClusterRole</code> in it.</p>
<p>You can use below commands to check permission of a service account</p>
<pre><code>kubectl auth can-i --list --as=system:serviceaccount:project-1:testsa
kubectl auth can-i --list --as=system:serviceaccount:project-1:testsa -n project-1
kubectl auth list pods --as=system:serviceaccount:project-1:testsa
kubectl auth list pods --as=system:serviceaccount:project-1:testsa -n project-1
</code></pre>
