<p>I want to create a used for kubernetes. I tried this:</p>
<pre><code>root@node1:~# kubectl create sa cicd
serviceaccount/cicd created
root@node1:~# kubectl get sa,secret
NAME                                SECRETS   AGE
serviceaccount/cicd                 0         5s
serviceaccount/default              0         23h
serviceaccount/my-service-account   0         20h

NAME          TYPE                                  DATA   AGE
secret/cicd   kubernetes.io/service-account-token   3      20h
root@node1:~# cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: cicd
spec:
  serviceAccount: cicd
  containers:
  - image: nginx
    name: cicd
EOF
pod/cicd created
root@node1:~# kubectl exec cicd -- cat /run/secrets/kubernetes.io/serviceaccount                                                                  /token &amp;&amp; echo
error: unable to upgrade connection: container not found (&quot;cicd&quot;)
root@node1:~# kubectl exec cicd --cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo
error: unknown flag: --cat
See 'kubectl exec --help' for usage.
root@node1:~# kubectl exec cicd -- cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo
eyJhbGciOiJSUzI1NiIsImtpZCI6Ii1I........
root@node1:~# kubectl create token cicd
eyJhbGciOiJSUzI1NiIsImtpZCI.......
root@node1:~# kubectl create token cicd --duration=999999h
eyJhbGciOiJSUzI1NiIsImtp.........tOkAmd                                          DxF0vr11MhUozH3uBIHKykzPkHRRKw
root@node1:~# cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: cicd
  annotations:
    kubernetes.io/service-account.name: &quot;cicd&quot;
EOF
secret/cicd configured
root@node1:~# kubectl get sa,secret
NAME                                SECRETS   AGE
serviceaccount/cicd                 0         67s
serviceaccount/default              0         23h
serviceaccount/my-service-account   0         20h
root@node1:~# kubectl describe secret cicd
Error from server (NotFound): secrets &quot;cicd&quot; not found
root@node1:~# kubectl describe secret cicd
Error from server (NotFound): secrets &quot;cicd&quot; not found
root@node1:~# kubectl describe sa cicd
Name:                cicd
Namespace:           default
Labels:              &lt;none&gt;
Annotations:         &lt;none&gt;
Image pull secrets:  &lt;none&gt;
Mountable secrets:   &lt;none&gt;
Tokens:              &lt;none&gt;
Events:              &lt;none&gt;
root@node1:~# kubectl get sa cicd -oyaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2023-03-14T12:39:07Z&quot;
  name: cicd
  namespace: default
  resourceVersion: &quot;130633&quot;
  uid: 1fdc7419-26b0-41a5-af56-6e21171efd3b
root@node1:~# kubectl get sa,secret
NAME                                SECRETS   AGE
serviceaccount/cicd                 0         96s
serviceaccount/default              0         23h
serviceaccount/my-service-account   0         20h
root@node1:~# ^C
root@node1:~# curl -k  https://localhost:6443/api/v1/namespaces -H &quot;Authorization: Bearer eyJhbGciOiJSU......&quot;
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {},
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;namespaces is forbidden: User \&quot;system:serviceaccount:default:cicd\&quot; cannot list resource                                           \&quot;namespaces\&quot; in API group \&quot;\&quot; at the cluster scope&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;kind&quot;: &quot;namespaces&quot;
  },
  &quot;code&quot;: 403
root@node1:~#
</code></pre>
<p>I use kubernetes v1.25.6. Do you know how I can fix this issue?</p>

Peter Penzov
<p>You should create an associated clusterRole and clusterRoleBinding :</p>
<pre class="lang-bash prettyprint-override"><code>kubectl create clusterrole cicd --verb=get,list --resource=namespaces
kubectl create clusterrolebinding cicd --clusterrole=cicd --serviceaccount=default:cicd
</code></pre>
<p>If you've created your service account in another namespace that <code>default</code> make sure to update that last command accordingly</p>
