<p>I created following objects in k8s cluster. </p>

<ol>
<li>Namespace (<strong>testpsp</strong>) </li>
<li>Custom ServiceAccount (<strong>testuser</strong>) </li>
<li>Role and RoleBindings via. Manifest files</li>
</ol>

<p>Please see below the yaml files for Role and RoleBinding resources. </p>

<p><code>$ cat developer.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer
  namespace: testpsp
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - create
- apiGroups:
  - extensions
  - apps
  resources:
  - deployments
  - replicasets
  verbs:
  - '*'
</code></p>

<p><code>$ cat developer-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: testpsp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: developer
subjects:
 - kind: ServiceAccount
   name: testuser
</code></p>

<p>As you can see in above mentioned role manifest file, I have given <strong>CREATE permission</strong> on <code>Pod</code> resource to <code>testuser</code> Service account. But still I am getting the error. </p>

<p><strong>Error</strong></p>

<p><em>Error from server (Forbidden): error when creating "hello-pod.yaml": pods is forbidden: User "testuser" cannot create resource "pods" in API group "" in the namespace "testpsp"</em></p>

<p>Here is the Pod yaml file. Am i missing anything here? </p>

<p><code>
$ cat hello-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: hello-pod
  namespace: testpsp
spec:
  serviceAccountName: testuser
  containers:
  - name: hello-kubernetes
    image: paulbouwer/hello-kubernetes:1.5
    ports:
    - containerPort: 8080
</code></p>

<p>Here is the command that I'm running to create the Pod. </p>

<p><code>$ kubectl --as=testuser -n testpsp create -f hello-pod.yaml</code></p>

Sunny Goel
<p>while troubleshooting this issue, I noticed that instead of directly mentioning the ServiceAccount name in "as" flag in kubectl command, we need to use the following format </p>

<p><code>system:serviceaccount:&lt;namespace_name&gt;:&lt;serviceaccount_name&gt;</code></p>

<p>In my case, it will look like this - <strong>system:serviceaccount:testpsp:testuser</strong></p>

<p>Afterwards, it started working fine. </p>
