<p>My design is: EventController lives in &quot;default&quot; namespace and starts Jobs in &quot;gamespace&quot; namespace.</p>
<p>I'm getting this error trying to create a Job with the Node.js kubernetes client:</p>
<pre><code>jobs.batch is forbidden: User &quot;system:serviceaccount:default:event-manager&quot; cannot create resource &quot;jobs&quot; in API group &quot;batch&quot; in the namespace &quot;gamespace&quot;
</code></pre>
<p>from this line of code:</p>
<pre><code>const job = await batchV1Api.createNamespacedJob('gamespace', kubeSpec.job)
</code></pre>
<p>kubeSpec.job is:</p>
<pre><code> {
  apiVersion: 'batch/v1',
  kind: 'Job',
  metadata: {
    name: 'event-60da4bee95e237001d65e355',
    namespace: 'gamespace',
    labels: {
      tier: 'event-servers',
    }
  },
  spec: {
    backoffLimit: 1,
    activeDeadlineSeconds: 14400,
    ttlSecondsAfterFinished: 86400,
    template: { spec: [Object] }
  }
}
</code></pre>
<p>And here's my RBAC configuration:</p>
<pre><code>apiVersion: v1
kind: Namespace
metadata:
  name: gamespace

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: event-manager

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: event-manager-role
rules:
  - apiGroups: ['', 'batch'] # '' means &quot;core&quot;
    resources: ['jobs', 'services']
    verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: event-manager-clusterrole-binding
  # Specifies the namespace the ClusterRole can be used in.
  namespace: gamespace
subjects:
  - kind: ServiceAccount
    name: event-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: event-manager-role
</code></pre>
<p>The container making the function call is configured like this:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: eventcontroller-deployment
  labels:
    app: eventcontroller
spec:
  selector:
    matchLabels:
      app: eventcontroller
  replicas: 1
  template:
    metadata:
      labels:
        app: eventcontroller
    spec:
      # see accounts-namespaces.yaml
      serviceAccountName: 'event-manager'
      imagePullSecrets:
        - name: registry-credentials
      containers:
        - name: eventcontroller
          image: eventcontroller
          imagePullPolicy: Always
          envFrom:
            - configMapRef:
                name: eventcontroller-config
          ports:
            - containerPort: 3003
</code></pre>
<p>I'm not sure if I'm using the client incorrectly (why is namespace needed in the spec and the function call?), or if I've configured RBAC incorrectly.</p>
<p>Any suggestions?</p>
<p>Thank you!</p>

Michael Cole
<p>I can't comment so I will share some Ideas what could be an Issue and how i would further debug the problem.</p>
<p>For your Deployment you have no Namespace defined, could it be the case that the Pod is running in a different Namespace (!= gamespace), but your Service Account only applies for gameplay?</p>
<blockquote>
<p>A RoleBinding grants permissions within a specific namespace<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">1</a></p>
</blockquote>
<p>If this is not the error you might want to try to use a service account that is already created and gives all permissions for the start to rule out other errors.</p>
<p>Here an Example Manifest</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: all-permissions
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: service-account-all-permissions
    namespace: gameplay
</code></pre>
<p>Set the Service Account to 'service-account-all-permissions' in your Deployment and see if you still get an permission error from the Kubernetes API</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Source</a>.</p>
