title: Kubernetes API: cannot list resource "pods" in API group ""
body: <p>I'm trying to make a pod that will serve as the controller for other pods, basically creating and stopping them as needed. I initially created a ServiceAccount, a Role, a RoleBinding, and a simple Alpine container that I can use for testing with <code>curl</code>, all within a new Namespace. Here's my YAML file for all of this:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
  kind: Namespace
  metadata:
      name: nfv
      labels:
          name: nfv
  ---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
      name: nfv-svc
      namespace: nfv
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
      name: nfv-role
      namespace: nfv
  rules:
      - apiGroups:
          - ''
        resources:
          - 'pods'
        verbs:
          - 'create'
          - 'delete'
          - 'get'
          - 'list'
          - 'patch'
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
      name: nfv-rolebind
  subjects:
      - kind: ServiceAccount
        name: nfv-svc
        namespace: nfv
  roleRef:
      kind: Role
      name: nfv-role
      apiGroup: rbac.authorization.k8s.io
  ---
  apiVersion: v1
  kind: Pod
  metadata:
      name: sdn-test
      namespace: nfv
  spec:
      serviceAccountName: nfv-svc
      containers:
          - image: alpine:3.9
            name: sdn-test-container
            command:
                - sleep
                - &quot;10000&quot;
  </code></pre>
  <p>Then I attach to the alpine test container and do the following:</p>
  <pre class="lang-sh prettyprint-override"><code>apk add --update curl
  CA_CERT=/run/secrets/kubernetes.io/serviceaccount/ca.crt
  NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
  TOKEN=$(cat /run/secrets/kubernetes.io/serviceaccount/token)
  curl -H &quot;Authorization: Bearer $TOKEN&quot; --cacert $CA_CERT https://kubernetes.default/api/v1/namespaces/$NAMESPACE/pods
  </code></pre>
  <p>Then I get the following output:</p>
  <pre><code>{
    &quot;kind&quot;: &quot;Status&quot;,
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;metadata&quot;: {
      
    },
    &quot;status&quot;: &quot;Failure&quot;,
    &quot;message&quot;: &quot;pods is forbidden: User \&quot;system:serviceaccount:nfv:nfv-svc\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; in the namespace \&quot;nfv\&quot;&quot;,
    &quot;reason&quot;: &quot;Forbidden&quot;,
    &quot;details&quot;: {
      &quot;kind&quot;: &quot;pods&quot;
    },
    &quot;code&quot;: 403
  }
  </code></pre>
  <p>The <code>Role</code> should have sufficient permissions to list the pods in my namespace, so why is it not working? What am I missing? I'm using Kubernetes v1.18.2 on Ubuntu 16.04.</p>