<p>I have the following config</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: deploy-agent-rbac
subjects:
  - kind: ServiceAccount
    name: deploy-agent
    namespace: ais-service
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: deploy-agent
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::&lt;ACCOUNT_ID&gt;:role/pod-identity-role
</code></pre>
<p>I'm using the Golang Kubernetes API to watch for events, like so:</p>
<pre><code>watch, err := k.client.CoreV1().Pods(namespace).Watch(metav1.ListOptions{
    LabelSelector: fmt.Sprintf(&quot;service=%s&quot;, target),
})
</code></pre>
<p>However when I update/delete pods in that namespace, with the correct given label, it doesn't show any events. However when I run the same code locally, it does. I suspect the role used for my local environment how the correct permissions, but the namespace I'm running my service in doesn't.</p>
<p>When I run <code>$ kubectl auth can-i watch deployments --namespace default --as cluster-admin</code>, I get &quot;no&quot;.</p>

Ewan Valentine
<p>The <code>ClusterRoleBinding</code> refers to a serviceaccount in <code>ais-service</code> namespace but the serviceaccount does not have a namespace which means the service account is created in <code>default</code> namespace. Add namespace in serviceaccount</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: deploy-agent
  namespace: ais-service
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::&lt;ACCOUNT_ID&gt;:role/pod-identity-role
</code></pre>
<p>To verify the permission run below command</p>
<pre><code>kubectl auth can-i list deployments --as=system:serviceaccount:ais-service:deploy-agent -n ais-service
</code></pre>
