<p>I am seeing this error for user <code>jenkins</code> when deploying.</p>
<pre><code>Error: pods is forbidden: User &quot;system:serviceaccount:ci:jenkins&quot; cannot list pods in the namespace &quot;kube-system&quot;
</code></pre>
<p>I have created a definition for service account</p>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: jenkins
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/exec&quot;]
  verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/log&quot;]
  verbs: [&quot;get&quot;,&quot;list&quot;,&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  verbs: [&quot;get&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins
</code></pre>
<p>I have created a ClusterRoleBinding</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: kube-system
</code></pre>
<p>Any advice?</p>

Bob
<p>Without a namespace (in the ServiceAccount creation) you will automatically create it in the <code>default</code> namespace. The same with a Role (which is always a one-namespace resource).</p>
<p>What you need to do is to create a ClusterRole with the correct permissions (basically just change your role into a ClusterRole) and then set the correct namespace either on the ServiceAccount resource or in the ClusterRole binding.</p>
<p>You can also skip creating the Role and RoleBinding, as the ClusterRole and ClusterRoleBinding will override it either way.</p>
<p>--</p>
<p>With that said. It's always good practice to create a specific ServiceAccount and RoleBinding per namespace when it comes to deploys, so that you don't accidently create an admin account which is used in a remote CI tool like... Jenkins ;)</p>
