This RBAC error occurs when a pod's ServiceAccount lacks permission to access Kubernetes resources. Fix it by creating a Role with required permissions and binding it to the ServiceAccount.
The "serviceaccount cannot list resource" error indicates that a pod's ServiceAccount doesn't have RBAC permissions to perform the requested API operation. By default, ServiceAccounts in Kubernetes have no permissions—they can't list pods, read secrets, or access any cluster resources. When a pod runs, it uses a ServiceAccount (default: "default" in each namespace). If your application needs to interact with the Kubernetes API (list pods, watch deployments, create configmaps), you must explicitly grant those permissions through RBAC. This error commonly affects operators, controllers, monitoring tools, and any application that uses the Kubernetes client library to interact with the cluster.
Check which ServiceAccount the pod uses:
# Get ServiceAccount used by pod
kubectl describe pod <pod-name> | grep ServiceAccount
# Test current permissions
kubectl auth can-i list pods \
--as=system:serviceaccount:<namespace>:<service-account-name> \
-n <namespace>Response "no" confirms the permission issue.
Create a dedicated ServiceAccount for your application:
kubectl create serviceaccount my-app-sa -n my-namespace
# Verify creation
kubectl get serviceaccount my-app-sa -n my-namespaceOr with YAML:
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-app-sa
namespace: my-namespaceDefine permissions needed by your application:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-reader
namespace: my-namespace
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["services"]
verbs: ["get", "list"]Apply:
kubectl apply -f role.yamlBind the role to the ServiceAccount:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: pod-reader-binding
namespace: my-namespace
subjects:
- kind: ServiceAccount
name: my-app-sa
namespace: my-namespace
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.ioApply and verify:
kubectl apply -f rolebinding.yaml
kubectl get rolebinding -n my-namespaceConfigure your deployment to use the ServiceAccount:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
namespace: my-namespace
spec:
template:
spec:
serviceAccountName: my-app-sa # Use custom SA
containers:
- name: app
image: my-app:latestApply and verify:
kubectl apply -f deployment.yaml
kubectl describe pod <new-pod-name> | grep ServiceAccountTest that the ServiceAccount now has access:
# Test permissions
kubectl auth can-i list pods \
--as=system:serviceaccount:my-namespace:my-app-sa \
-n my-namespace
# Check pod logs for successful API calls
kubectl logs <pod-name>
# Test from inside the pod
kubectl exec -it <pod-name> -- \
wget -qO- --header="Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
https://kubernetes.default.svc/api/v1/namespaces/my-namespace/podsProjected Service Account Tokens (Kubernetes 1.22+):
Modern Kubernetes uses short-lived, automatically rotating tokens:
- Default lifespan: 1 hour
- Automatically refreshed by kubelet
- Audience-bound and object-bound
Disable Auto-Mounting for security:
spec:
serviceAccountName: my-app-sa
automountServiceAccountToken: false # Pods that don't need API accessClusterRole for Cross-Namespace Access:
Use ClusterRole + ClusterRoleBinding when the ServiceAccount needs to access resources across multiple namespaces.
Common Patterns:
- Operators: Need ClusterRole to watch resources cluster-wide
- Monitoring: Need get/list on pods, nodes, metrics
- Controllers: Need create/update/delete on managed resources
Debugging:
kubectl auth can-i list pods \
--as=system:serviceaccount:my-namespace:my-app-sa -v=9No subnets found for EKS cluster
How to fix "eks subnet not found" in Kubernetes
unable to compute replica count
How to fix "unable to compute replica count" in Kubernetes HPA
error: context not found
How to fix "error: context not found" in Kubernetes
default backend - 404
How to fix "default backend - 404" in Kubernetes Ingress
must specify requests.cpu, requests.memory
How to fix "must specify requests.cpu, requests.memory" in Kubernetes