<p>I have created a service account &quot;serviceacc&quot; in a namespace xyz and gave it needed permissions. Yet it could not list pods. Here are the steps I followed.</p>
<pre><code>$kubectl create namespace xyz

$kubectl apply -f objects.yaml
</code></pre>
<p>Where content of objects.yaml</p>
<pre><code>---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: xyz
  name: listpodser
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;pod&quot;]
    verbs: [&quot;get&quot;, &quot;list&quot;]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: xyz
  name: service-listpodser
subjects:
  - kind: ServiceAccount
    name: serviceacc 
    apiGroup: &quot;&quot;
roleRef:
  kind: Role
  name: listpodser
  apiGroup: &quot;&quot;

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: serviceacc
  namespace: xyz
</code></pre>
<p>Then I checked if the service account has permission to list pods:</p>
<pre><code>$ kubectl auth can-i get pods --namespace  xyz --as system:serviceaccount:xyz:serviceacc
no

$ kubectl auth can-i list pods --namespace  xyz --as system:serviceaccount:xyz:serviceacc
no
</code></pre>
<p>As we can see from the output of above command, it cannot get/list pods.</p>

Nipun Talukdar
<p>Simple naming confusion. Use <code>pods</code> instead of <code>pod</code> in the resource list.</p>
