<p>When I try to create a resource from a node.js application via http request I get this error.</p>
<pre><code>{
  kind: 'Status',
  apiVersion: 'v1',
  metadata: {},
  status: 'Failure',
  message: 'prometheusrules.monitoring.coreos.com is forbidden: User ' +
    '&quot;system:serviceaccount:default:default&quot; cannot create resource ' +
    '&quot;prometheusrules&quot; in API group &quot;monitoring.coreos.com&quot; in the ' +
    'namespace &quot;default&quot;',
  reason: 'Forbidden',
  details: { group: 'monitoring.coreos.com', kind: 'prometheusrules' },
  code: 403
}
</code></pre>
<p>How do I add permissions to <code>system:serviceaccount:default:default</code>?</p>
<p>I have tried with the following <code>ClusterRole</code></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sla-manager-service-role
  labels:
    app: sla-manager-app
rules:
- apiGroups: [&quot;&quot;] # &quot;&quot; indicates the core API group
  resources: [&quot;services&quot;, &quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
</code></pre>
<p>But it is not working. The service for my node.js application looks like this</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: sla-manager-service
  labels:
    app: sla-manager-app
    monitoring: &quot;true&quot;
  annotations:
    prometheus.io/scrape: &quot;true&quot;
    prometheus.io/path: /metrics
    prometheus.io/port: &quot;6400&quot;
spec:
  selector:
    app: issue-manager-app
  ports:
    - protocol: TCP
      name: http
      port: 80
      targetPort: 6400
</code></pre>

Jonas
<p>You need a <code>Role</code> to define the permissions.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: sla-manager-service-role
  namespace: default
  labels:
    app: sla-manager-app
rules:
- apiGroups: [&quot;monitoring.coreos.com&quot;] # &quot;&quot; indicates the core API group
  resources: [&quot;prometheusrules&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
</code></pre>
<p>Then assign the above <code>Role</code> to the service account using a <code>RoleBinding</code>. This will give the permissions to the service account.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: sla-manager-service-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
</code></pre>
<p>Verify the service account's permission using below command</p>
<pre><code>kubectl auth can-i create prometheusrules --as=system:serviceaccount:default:default -n default
</code></pre>
