title: User "system:serviceaccount:default:flink" cannot list resource "nodes" in API group "" at the cluster scope
body: <p>I am trying to call k8s api in one k8s pod. But hit the following permission issue:</p>
  <pre><code>User &quot;system:serviceaccount:default:flink&quot; cannot list resource &quot;nodes&quot; in API group &quot;&quot; at the cluster scope.
  </code></pre>
  <p>In my yaml file, I already have specified the <code>Role</code> &amp; <code>RoleBinding</code>. What do I miss here?</p>
  <pre><code>---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: flink
  ---
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: zeppelin-server-role
  rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;pods&quot;, &quot;services&quot;, &quot;configmaps&quot;, &quot;deployments&quot;, &quot;nodes&quot;]
    verbs: [&quot;create&quot;, &quot;get&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;list&quot;, &quot;delete&quot;, &quot;watch&quot;]
  - apiGroups: [&quot;rbac.authorization.k8s.io&quot;]
    resources: [&quot;roles&quot;, &quot;rolebindings&quot;]
    verbs: [&quot;bind&quot;, &quot;create&quot;, &quot;get&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;list&quot;, &quot;delete&quot;, &quot;watch&quot;]
  ---
  kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: zeppelin-server-role-binding
    namespace: default
  subjects:
  - kind: ServiceAccount
    name: flink
  roleRef:
    kind: ClusterRole
    name: zeppelin-server-role
    apiGroup: rbac.authorization.k8s.io
  </code></pre>