<p>I am trying to access a kubernetes cluster using the rest api. I followed the instructions of <a href="https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/" rel="nofollow noreferrer">this</a> but i wanted to get the pods of the cluster.</p>

<pre class="lang-sh prettyprint-override"><code>APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
SECRET_NAME=$(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}')
TOKEN=$(kubectl get secret $SECRET_NAME -o jsonpath='{.data.token}' | base64 --decode)

curl $APISERVER/api/v1/pods --header "Authorization: Bearer $TOKEN" --insecure
</code></pre>

<p>the result is: </p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403
</code></pre>

<p>I tried the same <code>(curl localhost:8001/api/v1/pods)</code> by running the command:</p>

<pre><code>kubectl proxy --address='0.0.0.0' --disable-filter=true
</code></pre>

<p>at the master node of the cluster and now it works as desired.</p>

<p>How can I make the Athorization Bearer work in the same manner? </p>

Andreas Foteas
<p>You are using <code>default</code> service account to get pods. <code>default</code> serviceaccount don't have that permission. You can check an action is allowed or not by running</p>

<pre><code>$ kubectl auth can-i get pods --as system:serviceaccount:default:default
no

</code></pre>

<blockquote>
  <p>"message": "pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" at the cluster scope",</p>
</blockquote>

<p>as can be seen above the default service account cannot list pods</p>

<p>but when given proper role and role binding like below</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: demo-role
  namespace: default
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: demo-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: demo-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
</code></pre>

<p>Now if you check </p>

<pre><code>$ kubectl auth can-i get pods --as system:serviceaccount:default:default
yes
</code></pre>

<p>If you want to list pods of default namespace using api then run</p>

<pre><code>$ APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
$ SECRET_NAME=$(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}')
$ TOKEN=$(kubectl get secret $SECRET_NAME -o jsonpath='{.data.token}' | base64 --decode)

$ curl $APISERVER/api/v1/namespaces/default/pods --header "Authorization: Bearer $TOKEN" --insecure
{
  "kind": "PodList",
  "apiVersion": "v1",
  "metadata": {
    "selfLink": "/api/v1/namespaces/default/pods",
    "resourceVersion": "1589"
  },
  "items": []
}
</code></pre>
