<p>I have two pods in a cluster. Lets call them A and B. I've installed kubectl inside pod A and I am trying to run a command inside pod B from pod A using <code>kubectl exec -it podB -- bash</code>.
I am getting the following error </p>

<p><code>Error from server (Forbidden): pods "B" is forbidden: User "system:serviceaccount:default:default" cannot create pods/exec in the namespace "default"</code></p>

<p>I've created the following Role and RoleBinding to get access.
Role yaml</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: api-role
  namespace: default
  labels:
    app: tools-rbac
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
</code></pre>

<p>RoleBinding yaml</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: global-rolebinding
  namespace: default
  labels:
    app: tools-rbac
subjects:
- kind: Group
  name: system:serviceaccounts
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Any help is greatly appreciated. Thank you</p>

samsri
<p>You would need to give access to the <code>pods/exec</code> subresource in addition to <code>pods</code> like you have there. That said, this is a very weird thing to do and probably think very hard as to if this is the best solution.</p>
