<p>I want to access to the kubernetes deployment objects via api server . </p>

<p>I have a service account file shown as below .</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: name
  namespace: namespace

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: name
  namespace: namespace
rules:
- apiGroups: [""]
  resources: ["deployment"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["deployment/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["deployment/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: name
  namespace: namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: name
subjects:
- kind: ServiceAccount
  name: name
</code></pre>

<p>I'm getting 403 Forbidden error the token with owner of this service-accounts while access the endpoint </p>

<pre><code>/apis/apps/v1beta1/namespaces/namespace/deployments
</code></pre>

ColossusMark1
<p>All of your role's rules are for the core (empty) <a href="https://kubernetes.io/docs/reference/using-api/api-overview/#api-groups" rel="nofollow noreferrer">API group</a>.  However, the URL you're trying to access, <code>/apis/apps/v1beta1</code>, is in the "apps" API group (the part of the path after <code>/apis</code>).  So to access that particular API path, you need to change the role definition to</p>

<pre><code>rules:
- apiGroups: ["apps"]
  resources: ["deployment"]
  verbs: ["create","delete","get","list","patch","update","watch"]
# and also the other deployment subpaths
</code></pre>
