<p>I created a <code>serviceAccount</code> resource named <code>my-app-cluster-access</code>. Then supply that resource name in the <code>service_account_name</code> argument in the <code>KubernetesPodOperator</code>. But I keep getting the error </p>

<pre><code>HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:my-release-name:default\" cannot create resource \"pods\" in API group \"\" in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}
</code></pre>

<p>The message seem to indicate that the supplied value of the <code>service_account_name</code> is not being applied since the message still has the <code>default</code> text. I check the <code>KubernetesPodOperator</code> source code and look likes the mapping is there. </p>

<p>Before I created <code>ServiceAccount</code> resource, I also got that same error message. Do I need to create a <code>ServiceAccount</code> resource to use that operator? I need to be able to use <code>KubernetesPodOperator</code> and so far is not working after adding the <code>ServiceAccount</code>. I already set the <code>in_cluster</code> arg to <code>True</code>.</p>

alltej
<p>By default every namespace has a service account <code>default</code> The <code>default</code> service account does not have permission to create pods.</p>

<p>In your case a <code>default</code> service account from namespace <code>my-release-name</code> is trying to create a pod in <code>default</code> namespace.</p>

<p>You can check if a service account named <code>default</code> from namespace <code>my-release-name</code> has permission to create pods in <code>default</code> namespace.</p>

<pre><code>kubectl auth can-i create pods -n default--as=system:serviceaccount:my-release-name:default
</code></pre>

<p>This will return no.</p>

<p>So you can create a role like below </p>

<pre><code>kubectl create clusterrole pod-creator --verb=create,get,list,watch --resource=pods
</code></pre>

<p>and a clusterrolebinding</p>

<pre><code>kubectl create clusterrolebinding pod-creator-clusterrolebinding --clusterrole=pod-creator --serviceaccount=my-release-name:default
</code></pre>

<p>Above should work without a need to create a new service account.</p>
