<p>I'm trying to delete kubernetes pod via <code>go-client</code> library using the following code:</p>
<pre><code>err := ks.clientset.CoreV1().Pods(kubeData.PodNamespace).Delete(context.Background(), kubeData.PodName, metav1.DeleteOptions{})
if err != nil {
  log.Fatal(err)
}
</code></pre>
<p>However receiving an error:</p>
<blockquote>
<p>pods &quot;app-name&quot; is forbidden: User &quot;system:serviceaccount:default:app-name&quot; cannot delete resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;default&quot;&quot;</p>
</blockquote>
<p>Here is the serviceaccount.yaml:</p>
<pre><code>{{- $sa := print .Release.Name &quot;-&quot; .Values.serviceAccount -}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ $sa }}
  namespace: {{ .Release.Namespace }}

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $sa }}
rules:
  - apiGroups: [&quot;apps&quot;]
    verbs: [&quot;patch&quot;, &quot;get&quot;, &quot;list&quot;]
    resources:
      - deployments
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $sa }}
rules:
  - apiGroups: [&quot;apps&quot;]
    verbs: [&quot;delete&quot;, &quot;get&quot;, &quot;list&quot;]
    resources:
      - pods
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ $sa }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $sa }}
subjects:
  - kind: ServiceAccount
    name: {{ $sa }}
</code></pre>
<p>Looks like something related to user permissions, however not sure how to properly configure it.
Thanks.</p>

Avag Sargsyan
<p>As you can see from the error:</p>
<p><code>pods &quot;app-name&quot; is forbidden: User &quot;system:serviceaccount:default:app-name&quot; cannot delete resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;default&quot;&quot;</code></p>
<p>The important part is: <strong><code>in API group &quot;&quot;</code></strong></p>
<p>Take a look on your manifest:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $sa }}
rules:
  # - apiGroups: [&quot;apps&quot;] # &lt;-- BAD!
  - apiGroups: [&quot;&quot;] # &lt;-- GOOD!
    verbs: [&quot;delete&quot;, &quot;get&quot;, &quot;list&quot;]
    resources:
      - pods
</code></pre>
<p>This definition is specifying that a resource <code>Pod</code> is in the <code>apiGroup: apps</code> which is not correct and <code>&quot;&quot;</code> should be used instead.</p>
<p>More on that you can read here:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/reference/using-api/#api-groups" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: Using API: API Groups</a></em></li>
</ul>
