How to fix serviceaccount cannot list resource in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 7, 2025· 178 views

This RBAC error occurs when a pod's ServiceAccount lacks permission to access Kubernetes resources. Fix it by creating a Role with required permissions and binding it to the ServiceAccount.

Quick fix

Fixes serviceaccount cannot list resource

# Get ServiceAccount used by pod
kubectl describe pod <pod-name> | grep ServiceAccount

# Test current permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:<namespace>:<service-account-name> \
  -n <namespace>
  1. Identify the ServiceAccount and test permissions
  2. Create a custom ServiceAccount
  3. Create a Role with required permissions
  4. Create RoleBinding for ServiceAccount
kubernetes — error
# Get ServiceAccount used by pod
kubectl describe pod <pod-name> | grep ServiceAccount
# Test current permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:<namespace>:<service-account-name> \
  -n <namespace>
serviceaccount cannot list resource

What this error means

The "serviceaccount cannot list resource" error indicates that a pod's ServiceAccount doesn't have RBAC permissions to perform the requested API operation. By default, ServiceAccounts in Kubernetes have no permissions—they can't list pods, read secrets, or access any cluster resources. When a pod runs, it uses a ServiceAccount (default: "default" in each namespace). If your application needs to interact with the Kubernetes API (list pods, watch deployments, create configmaps), you must explicitly grant those permissions through RBAC. This error commonly affects operators, controllers, monitoring tools, and any application that uses the Kubernetes client library to interact with the cluster.

Typical symptoms

  • Pod logs show "forbidden" errors when calling Kubernetes API
  • Application receives 403 Forbidden from API server
  • Operator/controller fails to watch or modify resources
  • kubectl auth can-i returns "no" for ServiceAccount
  • In-cluster client library calls fail with permission errors

Common causes

  1. Default ServiceAccount has no permissions (by design)
  2. Custom ServiceAccount created but no RoleBinding exists
  3. RoleBinding references wrong ServiceAccount name or namespace
  4. Role missing required verb (list requires "list", not just "get")
  5. Using Role when ClusterRole needed for cluster-wide access

How to fix "serviceaccount cannot list resource"

1Identify the ServiceAccount and test permissions

Check which ServiceAccount the pod uses:

bash
# Get ServiceAccount used by pod
kubectl describe pod <pod-name> | grep ServiceAccount

# Test current permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:<namespace>:<service-account-name> \
  -n <namespace>

Response "no" confirms the permission issue.

2Create a custom ServiceAccount

Create a dedicated ServiceAccount for your application:

bash
kubectl create serviceaccount my-app-sa -n my-namespace

# Verify creation
kubectl get serviceaccount my-app-sa -n my-namespace

Or with YAML:

yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: my-namespace
3Create a Role with required permissions

Define permissions needed by your application:

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: my-namespace
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list"]

Apply:

bash
kubectl apply -f role.yaml
4Create RoleBinding for ServiceAccount

Bind the role to the ServiceAccount:

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader-binding
  namespace: my-namespace
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: my-namespace
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Apply and verify:

bash
kubectl apply -f rolebinding.yaml
kubectl get rolebinding -n my-namespace
5Update pod to use the ServiceAccount

Configure your deployment to use the ServiceAccount:

yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-namespace
spec:
  template:
    spec:
      serviceAccountName: my-app-sa  # Use custom SA
      containers:
      - name: app
        image: my-app:latest

Apply and verify:

bash
kubectl apply -f deployment.yaml
kubectl describe pod <new-pod-name> | grep ServiceAccount
6Verify permissions work

Test that the ServiceAccount now has access:

bash
# Test permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:my-namespace:my-app-sa \
  -n my-namespace

# Check pod logs for successful API calls
kubectl logs <pod-name>

# Test from inside the pod
kubectl exec -it <pod-name> -- \
  wget -qO- --header="Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
  https://kubernetes.default.svc/api/v1/namespaces/my-namespace/pods

Advanced notes

Projected Service Account Tokens (Kubernetes 1.22+):
Modern Kubernetes uses short-lived, automatically rotating tokens:
- Default lifespan: 1 hour
- Automatically refreshed by kubelet
- Audience-bound and object-bound

Disable Auto-Mounting for security:

yaml
spec:
  serviceAccountName: my-app-sa
  automountServiceAccountToken: false  # Pods that don't need API access

ClusterRole for Cross-Namespace Access:
Use ClusterRole + ClusterRoleBinding when the ServiceAccount needs to access resources across multiple namespaces.

Common Patterns:
- Operators: Need ClusterRole to watch resources cluster-wide
- Monitoring: Need get/list on pods, nodes, metrics
- Controllers: Need create/update/delete on managed resources

Debugging:

bash
kubectl auth can-i list pods \
  --as=system:serviceaccount:my-namespace:my-app-sa -v=9

Frequently asked questions

What does "serviceaccount cannot list resource" mean?
The "serviceaccount cannot list resource" error indicates that a pod's ServiceAccount doesn't have RBAC permissions to perform the requested API operation. By default, ServiceAccounts in Kubernetes have no permissions—they can't list pods, read secrets, or access any cluster resources. When a pod runs, it uses a ServiceAccount (default: "default" in each namespace).
How do I fix "serviceaccount cannot list resource"?
This RBAC error occurs when a pod's ServiceAccount lacks permission to access Kubernetes resources. Fix it by creating a Role with required permissions and binding it to the ServiceAccount.
What causes "serviceaccount cannot list resource"?
Default ServiceAccount has no permissions (by design) Custom ServiceAccount created but no RoleBinding exists RoleBinding references wrong ServiceAccount name or namespace
Is the "serviceaccount cannot list resource" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading