<p>it seems that my AKS cluster is unable to perform basic requests to the k8s api, i.e. using the in-cluster token for the pods. Everything works fine when I use the same code from my local machine, i.e. with <code>config.load_kube_config</code> .</p>

<p>I am using the python k8s client 11.0.0, and I am loading the configuration through <code>config.load_incluster_config()</code>. I get the following error:</p>

<p><code>HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}</code></p>

<p>when trying to simply list my pods (using <code>client.list_namespaced_pod</code>). I also tried to perform a raw get request, but same result.</p>

<p>I tried to extend the cluster role to specifically access the resources, here my clusterrole and clusterrolebinding:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: clusterrolename
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - get
  - list
- apiGroups:
  - metrics.k8s.io
  resources:
  - '*'
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: clusterrolebindingname
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: clusterrolename
subjects:
- kind: ServiceAccount
  name: default
  namespace: mynamespace
</code></pre>

<p>but I have always the same result.</p>

<p>The same approach does not work equally on linux and windows nodes.</p>

<p>The use of the very same approach was successful before on linux machine (pure linux cluster).</p>

<p>Could it be related to the SDK version?
Could it be something different in the cluster?
Does anyone know how I could retrieve a list of the authorisation for any specific ServiceAccount?</p>

Neo
<p>You can check specific permission of a service account in a specific namespace using below command</p>

<pre><code>kubectl auth can-i get pods --as=system:serviceaccount:mynamespace:default -n mynamespace
</code></pre>

<p>If the above command returns <code>no</code> that means the service account does not have right RBAC.</p>

<p>To list all permission of a service account use</p>

<pre><code>kubectl auth can-i --list --as=system:serviceaccount:mynamespace:default
</code></pre>

<p>To know more use <code>kubectl auth can-i -h</code> </p>
