<p>I created a service account user and got the token for the user. However, ever time I try to access the names spaces I get the following error:</p>
<pre><code>{
    &quot;kind&quot;: &quot;Status&quot;,
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;metadata&quot;: {},
    &quot;status&quot;: &quot;Failure&quot;,
    &quot;message&quot;: &quot;namespaces is forbidden: User \&quot;system:serviceaccount:default:svcacc\&quot; cannot list resource \&quot;namespaces\&quot; in API group \&quot;\&quot; at the cluster scope&quot;,
    &quot;reason&quot;: &quot;Forbidden&quot;,
    &quot;details&quot;: {
        &quot;kind&quot;: &quot;namespaces&quot;
    },
    &quot;code&quot;: 403
}
</code></pre>
<p>This is my service account:</p>
<pre><code>Name:         svcacc-token-87jd6
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubernetes.io/service-account.name: svcacc
              kubernetes.io/service-account.uid: 384aa590-dac4-472c-a9a7-116c5fb0562b

Type:  kubernetes.io/service-account-token
</code></pre>
<p>Do I need to give the service account roles or add it to a group? This is running in AWS EKS, not sure if that make a difference.</p>
<p>I am trying to use ServiceNow discovery to discover my Kubernetes cluster. Regardless if I am using ServiceNow or Postman, I get the same message.</p>
<p>EDIT:
Ended up using YAML to configure the service account and roles.</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: svcacc
  namespace: default
---
# Create ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: svcacc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: svcacc
  namespace: default
</code></pre>
<p>Once this was configured I updated the <code>kubeconfig</code> and ran to get token:</p>
<pre><code>$(kubectl describe secrets &quot;$(kubectl describe serviceaccount svcacc -n default| grep -i Tokens | awk '{print $2}')&quot; -n default | grep token: | awk '{print $2}')
</code></pre>

Brandon Wilson
<p>To clarify I am posting a Community Wiki answer.</p>
<p>You solved this problem using YAML file to configure the service account and roles.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: svcacc
  namespace: default
---
# Create ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: svcacc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: svcacc
  namespace: default
</code></pre>
<p>And after that you updated the <code>kubeconfig</code> and ran to get token:</p>
<pre class="lang-yaml prettyprint-override"><code>$(kubectl describe secrets &quot;$(kubectl describe serviceaccount svcacc -n default| grep -i Tokens | awk '{print $2}')&quot; -n default | grep token: | awk '{print $2}')
</code></pre>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Here</a> is documentation about RBAC Authorization with many examples.</p>
<blockquote>
<p>Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.</p>
</blockquote>
