<p>I'm trying to make a pod that will serve as the controller for other pods, basically creating and stopping them as needed. I initially created a ServiceAccount, a Role, a RoleBinding, and a simple Alpine container that I can use for testing with <code>curl</code>, all within a new Namespace. Here's my YAML file for all of this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Namespace
metadata:
    name: nfv
    labels:
        name: nfv
---
apiVersion: v1
kind: ServiceAccount
metadata:
    name: nfv-svc
    namespace: nfv
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: nfv-role
    namespace: nfv
rules:
    - apiGroups:
        - ''
      resources:
        - 'pods'
      verbs:
        - 'create'
        - 'delete'
        - 'get'
        - 'list'
        - 'patch'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: nfv-rolebind
subjects:
    - kind: ServiceAccount
      name: nfv-svc
      namespace: nfv
roleRef:
    kind: Role
    name: nfv-role
    apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Pod
metadata:
    name: sdn-test
    namespace: nfv
spec:
    serviceAccountName: nfv-svc
    containers:
        - image: alpine:3.9
          name: sdn-test-container
          command:
              - sleep
              - &quot;10000&quot;
</code></pre>
<p>Then I attach to the alpine test container and do the following:</p>
<pre class="lang-sh prettyprint-override"><code>apk add --update curl
CA_CERT=/run/secrets/kubernetes.io/serviceaccount/ca.crt
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
TOKEN=$(cat /run/secrets/kubernetes.io/serviceaccount/token)
curl -H &quot;Authorization: Bearer $TOKEN&quot; --cacert $CA_CERT https://kubernetes.default/api/v1/namespaces/$NAMESPACE/pods
</code></pre>
<p>Then I get the following output:</p>
<pre><code>{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {
    
  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;pods is forbidden: User \&quot;system:serviceaccount:nfv:nfv-svc\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; in the namespace \&quot;nfv\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;kind&quot;: &quot;pods&quot;
  },
  &quot;code&quot;: 403
}
</code></pre>
<p>The <code>Role</code> should have sufficient permissions to list the pods in my namespace, so why is it not working? What am I missing? I'm using Kubernetes v1.18.2 on Ubuntu 16.04.</p>

mewais
<p>There needs to be a namespace <code>namespace: nfv</code> in the <code>RoleBinding</code> because it's  a namespace scoped resource.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: nfv-rolebind
    namespace: nfv
subjects:
    - kind: ServiceAccount
      name: nfv-svc
      namespace: nfv
roleRef:
    kind: Role
    name: nfv-role
    apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>To verify the permission you can use below command</p>
<pre><code>kubectl auth can-i list pods --as=system:serviceaccount:nfv:nfv-svc -n nfv
yes
</code></pre>
