<p>I did this:</p>
<ol>
<li>I created a service account</li>
</ol>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: myname
...
</code></pre>
<ol start="2">
<li>I generate the token from the secret created in the service account:</li>
</ol>
<p><code>token=$(kubectl get secrets myname-xxxx-xxxx -o jsonpath={.data.token} | base64 --decode)</code></p>
<ol start="3">
<li><p>I set credentials for the serviceAccount <code>myname</code> created:<br />
<code>kubectl config set-credentials myname --token=$token</code></p>
</li>
<li><p>I created a context
<code>kubectl config set-context myname-context --cluster=my-cluster --user=myname</code></p>
</li>
<li><p>then I created a copie of ~/.kube/config and delete the cluster-admin entries (letting only the user myname)</p>
</li>
<li><p>I rolebinded the user to a specific namespace with the edit clusterRole permissions:</p>
</li>
</ol>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: 
  name: dev-access
  namespace: my-ns
roleRef: 
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects: 
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: myname
EOF
</code></pre>
<ol start="7">
<li>I sent the edited <code>~/.kube/config</code> to the person who want to access the cluster, now he can lists the pods but not exec into them:</li>
</ol>
<p><strong>Error</strong></p>
<pre><code>(Forbidden): pods &quot;pod-xxxxx-xxxx&quot; is forbidden: User &quot;system:serviceaccount:default:myname&quot; cannot create resource &quot;pods/exec&quot; in API group &quot;&quot; in the namespace &quot;my-ns&quot;
</code></pre>
<p>I want to do that from a non master machine which have the master <code>~/.kube/config</code> copied into it.</p>
<p>Thanks</p>

Khalil Meg
<p>The <code>RoleBinding</code> that you have is binding the <code>ClusterRole</code> to a <code>User</code> and not a <code>ServiceAccount</code>. The error clearly shows a ServiceAccount <code>system:serviceaccount:default:myuser</code> So the <code>RoleBinding</code> should be as below</p>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: 
  name: dev-access
  namespace: my-ns
roleRef: 
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects: 
  - kind: ServiceAccount
    name: myuser
    namespace: default
EOF
</code></pre>
<p>To verify all permissions of the <code>ServiceAccount</code> <code>myuser</code> use below command</p>
<pre><code>kubectl auth can-i --list --as=system:serviceaccount:default:myuser
</code></pre>
<p>To verify specific permission of <code>pods/exec</code> of the <code>ServiceAccount</code> <code>myuser</code> use below command</p>
<pre><code>kubectl auth can-i create pods/exec --as=system:serviceaccount:default:myuser
</code></pre>
