<p>I have two namespaces: <code>n1</code> (for running EC2 instances) and <code>fargate</code> (connected to Fargate profile).<br />
There is <code>data-processor</code> account in n1.<br />
I'd like to allow data-processor account to run pods in <code>fargate</code> name space.</p>
<p>Now, I'm getting the following error:</p>
<pre><code>Exception in thread &quot;main&quot; io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://&lt;cluster-id&gt;.gr7.us-west-2.eks.amazonaws.com/api/v1/namespaces/fargate/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User &quot;system:serviceaccount:n1:data-processor&quot; cannot create resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;fargate&quot;.
</code></pre>

Lesha Pipiev
<p>You haven't provided any of the roles or rolebindings so we can't see what permissions you have set already, but if you apply the following manifest it should work:</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: data-processor-role
rules:
- apiGroups: ['']
  resources: ['pods']
  verbs: ['get', 'watch', 'list', 'create', 'patch', 'update', 'delete']
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: data-processor-rolebinding
  namespace: fargate
subjects:
- kind: ServiceAccount
  name: data-processor
  namespace: n1
roleRef:
  kind: ClusterRole
  name: data-processor-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>That should allow your data-processor service account read/write permissions to pods in the fargate namespace.</p>
