<p>I have a requirement to get the resource details inside the pod and do some operations depend upon the result. I'm using k8s client python inside the pod. After the role/rolebinding i'm getting forbidden.</p>
<p>i have created Serviceaccount/role/rolebinding as like below.</p>
<p>Can any one help me in this issue.</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
name: myaccount
namespace: dev
          
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: dev
name: pods-reader-role
rules:
-apiGroups: [&quot;*&quot;]
resources: [&quot;*&quot;]
verbs: [&quot;*&quot;]

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: pod-controller
namespace: dev
subjects:
- kind: ServiceAccount
name: myaccount
apiGroup: &quot;&quot;
roleRef:
kind: Role
name: pods-reader-role
apiGroup: &quot;&quot;


Listing pods with their IPs:
Traceback (most recent call last):
  File &quot;/opt/scripts/bin/PodCont.py&quot;, line 792, in &lt;module&gt;
    main()
  File &quot;/opt/scripts/bin/PodCont.py&quot;, line 596, in main
    ret = v1.list_pod_for_all_namespaces(watch=False)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/api/core_v1_api.py&quot;, line 16864, in list_pod_for_all_namespaces
    return self.list_pod_for_all_namespaces_with_http_info(**kwargs)  # noqa: E501
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/api/core_v1_api.py&quot;, line 16981, in list_pod_for_all_namespaces_with_http_info
    collection_formats=collection_formats)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/api_client.py&quot;, line 353, in call_api
    _preload_content, _request_timeout, _host)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/api_client.py&quot;, line 184, in __call_api
    _request_timeout=_request_timeout)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/api_client.py&quot;, line 377, in request
    headers=headers)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/rest.py&quot;, line 243, in GET
    query_params=query_params)
  File &quot;/usr/local/lib/python3.6/site-packages/kubernetes/client/rest.py&quot;, line 233, in request
    raise ApiException(http_resp=r)
kubernetes.client.exceptions.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Mon, 05 Apr 2021 09:47:13 GMT', 'Content-Length': '285'})
HTTP response body: {&quot;kind&quot;:&quot;Status&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{},&quot;status&quot;:&quot;Failure&quot;,&quot;message&quot;:&quot;pods is forbidden: User \&quot;system:serviceaccount:dev:deploy-svc-account\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; at the cluster scope&quot;,&quot;reason&quot;:&quot;Forbidden&quot;,&quot;details&quot;:{&quot;kind&quot;:&quot;pods&quot;},&quot;code&quot;:403}
</code></pre>

Santhoo Kumar
<p>Answering the question, I think there are some things that should be considered:</p>
<ul>
<li>Indentation</li>
<li>Service account running the <code>Pod</code></li>
<li>Python code and access scopes</li>
</ul>
<p>As there is no <a href="https://stackoverflow.com/help/minimal-reproducible-example">minimal, reproducible example</a> we can at most assume on how exactly you've configured your setup.</p>
<hr />
<h3>Indentation</h3>
<p>The <code>YAML</code> manifest that you've included will is not indented correctly. The correct manifest should look like below:</p>
<ul>
<li><code>full.yaml</code>:</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: myaccount
  namespace: dev
---          
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev
  name: pods-reader-role
rules:
- apiGroups: [&quot;*&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: pod-controller
  namespace: dev
subjects:
- kind: ServiceAccount
  name: myaccount
  apiGroup: &quot;&quot;
roleRef:
  kind: Role
  name: pods-reader-role
  apiGroup: &quot;&quot;
</code></pre>
<blockquote>
<p>A side note!</p>
<p>Consider creating more restrictive <code>Role</code> for your use case as it's allowing to do everything in the <code>dev</code> namespace.</p>
</blockquote>
<hr />
<h3>Service account running the <code>Pod</code></h3>
<p>The potential issue here is that you've created a <code>serviceAccount</code> with a name: <code>myaccount</code>
and the <code>Pod</code> is trying to authenticate using the <code>deploy-svc-account</code>. (<code>User \&quot;system:serviceaccount:dev:deploy-svc-account\&quot; cannot list resource</code>)</p>
<p>Please ensure that the correct <code>serviceAccount</code> is used to run a <code>Pod</code>.</p>
<p>Example:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: sdk
  namespace: dev
spec:
  serviceAccountName: myaccount # &lt;-- IMPORTANT
  containers:
  - image: google/cloud-sdk
    command:
      - sleep
      - &quot;infinity&quot;
    imagePullPolicy: IfNotPresent
    name: sdk
  restartPolicy: Always
</code></pre>
<hr />
<h3>Python code and access scopes</h3>
<p>Assuming that you've used the code from the documentation page of Kubernetes Python API library (<code>&quot;Listing pods with their IPs:&quot;</code>):</p>
<ul>
<li><em><a href="https://github.com/kubernetes-client/python/" rel="nofollow noreferrer">Github.com: Kubernetes client: Python</a></em></li>
</ul>
<p>There are 2 topics to consider here:</p>
<ul>
<li>Access scopes</li>
<li>Querying the resources</li>
</ul>
<p>Citing the official documentation:</p>
<blockquote>
<p><strong>A Role always sets permissions within a particular namespace</strong>; when you create a Role, you have to specify the namespace it belongs in.</p>
<p><em><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: RBAC: Role and ClusterRole</a></em></p>
</blockquote>
<p>The permissions that you've assigned by a <code>Role</code> and a <code>RoleBinding</code> are for <code>dev</code> namespace only. If you would like to have full cluster scope you would need to create a <code>ClusterRole</code> and a <code>ClusterRoleBinding</code>.</p>
<p>I encourage you to check the documentation included in the citation as it has some examples to follow and there are many explanations on that matter.</p>
<p>Also, a word about the Python code:</p>
<pre class="lang-py prettyprint-override"><code>from kubernetes import client, config

# Configs can be set in Configuration class directly or using helper utility
config.load_incluster_config()

v1 = client.CoreV1Api()
print(&quot;Listing pods with their IPs:&quot;)
ret = v1.list_pod_for_all_namespaces(watch=False)
for i in ret.items:
    print(&quot;%s\t%s\t%s&quot; % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))
</code></pre>
<p>Focusing on:</p>
<pre class="lang-py prettyprint-override"><code>ret = v1.list_pod_for_all_namespaces(watch=False)
</code></pre>
<p>This code will query for <code>Pods</code> from all namespaces, that's why you've also receiving the error <code>cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; at the cluster scope&quot;</code>.</p>
<p>To list the <code>Pods</code> from a specific namespace you can use:</p>
<pre class="lang-py prettyprint-override"><code>ret = v1.list_namespaced_pod(namespace=&quot;dev&quot;, watch=False)
</code></pre>
<p>And by that you should be able to get:</p>
<ul>
<li><code>python3 program.py</code>:</li>
</ul>
<pre class="lang-sh prettyprint-override"><code>Listing pods with their IPs:
10.32.0.15  dev sdk
</code></pre>
