How to fix serviceaccount cannot list resource in Kubernetes

# Get ServiceAccount used by pod
kubectl describe pod <pod-name> | grep ServiceAccount

# Test current permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:<namespace>:<service-account-name> \
  -n <namespace>

kubectl create serviceaccount my-app-sa -n my-namespace

# Verify creation
kubectl get serviceaccount my-app-sa -n my-namespace

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: my-namespace

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: my-namespace
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list"]

kubectl apply -f role.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader-binding
  namespace: my-namespace
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: my-namespace
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f rolebinding.yaml
kubectl get rolebinding -n my-namespace

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-namespace
spec:
  template:
    spec:
      serviceAccountName: my-app-sa  # Use custom SA
      containers:
      - name: app
        image: my-app:latest

kubectl apply -f deployment.yaml
kubectl describe pod <new-pod-name> | grep ServiceAccount

# Test permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:my-namespace:my-app-sa \
  -n my-namespace

# Check pod logs for successful API calls
kubectl logs <pod-name>

# Test from inside the pod
kubectl exec -it <pod-name> -- \
  wget -qO- --header="Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
  https://kubernetes.default.svc/api/v1/namespaces/my-namespace/pods