<p>I am trying to access the Kubernetes service using C# docker within kuberentes service.</p>
<p>I have a python docker YAML file and want to create pod using the same YAML programmatically from c# Dotnet core docker that running int the same cluster of python docker. I found Kubernetes api for dotnet core.I created the code for list pods that is below.</p>
<pre><code>using System;
using k8s;

namespace simple
{
    internal class PodList
    {
        private static void Main(string[] args)
        {
            var config = KubernetesClientConfiguration.InClusterConfig();
            IKubernetes client = new Kubernetes(config);
            Console.WriteLine(&quot;Starting Request!&quot;);

            var list = client.ListNamespacedPod(&quot;default&quot;);
            foreach (var item in list.Items)
            {
                Console.WriteLine(item.Metadata.Name);
            }

            if (list.Items.Count == 0)
            {
                Console.WriteLine(&quot;Empty!&quot;);
            }
        }
    }
}
</code></pre>
<p>this code getting error  Forbidden (&quot;Operation returned an invalid status code 'Forbidden'&quot;).
instead of <strong>InClusterConfig</strong> using <strong>BuildConfigFromConfigFile</strong>  code is working in local environment.Is anythin I missed?</p>
<p>Edited</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-serviceaccount
  namespace: api

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: api
  name: test-role
rules:
    - apiGroups: [&quot;&quot;,&quot;apps&quot;,&quot;batch&quot;]
      # &quot;&quot; indicates the core API group
      resources: [&quot;deployments&quot;, &quot;namespaces&quot;,&quot;cronjobs&quot;]
      verbs: [&quot;get&quot;, &quot;list&quot;, &quot;update&quot;, &quot;patch&quot;,&quot;create&quot;]  
  

  
---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-binding
  namespace: api
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-role
subjects:
  - kind: ServiceAccount
    name: test-serviceaccount
    namespace: api

---


apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: &quot;4&quot;
  creationTimestamp: &quot;2019-07-04T16:05:43Z&quot;
  generation: 4
  labels:
    app: test-console
    tier: middle-end
  name: test-console
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: test-console
      tier: middle-end
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: &quot;2019-07-04T16:05:43Z&quot;
      labels:
        app: test-console
        tier: middle-end
    spec:
      serviceAccountName: test-serviceaccount
      containers:
      - image: test.azurecr.io/tester:1.0.0
        imagePullPolicy: Always
        name: test-console
        ports:
        - containerPort: 80
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      imagePullSecrets:
      - name: pull
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      
C# code

  client.CreateNamespacedCronJob(jobmodel, &quot;testnamesapce&quot;);
crone job
 'apiVersion': 'batch/v1beta1',
    'kind': 'CronJob',
    'metadata': {
        'creationTimestamp': '2020-08-04T06:29:19Z',
        'name': 'forcaster-cron',
        'namespace': 'testnamesapce'
    },
</code></pre>

Arun Thomas
<p><code>InClusterConfig</code> uses the <code>default</code> service account of the namespace where you are deploying the pod. By default that service account will not have any <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> which leads to <code>Forbidden</code> error.</p>
<p>The reason it works in local environment is because it uses credential from <code>kubeconfig</code> file which most of the time is admin credential having root level RBAC permission to the cluster.</p>
<p>You need to define a <code>Role</code> and attach that role to the service account using <code>RoleBinding</code></p>
<p>So if you are deploying the pod in <code>default</code> namespace then below RBAC should work.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: myrole
  namespace: default
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - pods
  verbs:
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: role-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: myrole
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
</code></pre>
<p>Once you apply above RBAC you can check permission of the service account using below command</p>
<pre><code>kubectl auth can-i list pods --as=system:serviceaccount:default:default -n default
yes
</code></pre>
