Kubernetes 'Error from server (Forbidden): pods is forbidden: User "x" cannot list resource "pods" in API group "" in the namespace "y"'. How do I grant the right RBAC permissions?

Cause: the Kubernetes API authenticated you (it knows who you are) but RBAC authorization denied the action. The message names the user or service account, the verb (list, get, create...), the resource, the API group and the namespace. Common reasons: a CI job or pod running as a service account without a RoleBinding, a RoleBinding in a different namespace than the one you're using, a Role that lists the wrong apiGroup (e.g. Deployments live in group 'apps', not ''), or a ClusterRole bound with a namespaced RoleBinding when cluster-wide access was intended. Fix: 1. Check exactly what is allowed: kubectl auth can-i list pods -n y --as <user> (for a service account: --as=system:serviceaccount:<ns>:<name>); kubectl auth can-i --list -n y shows all permissions. 2. Grant the minimum needed with a Role and RoleBinding in that namespace, for example: kubectl create role pod-reader --verb=get,list,watch --resource=pods -n y, then kubectl create rolebinding pod-reader-binding --role=pod-reader --serviceaccount=<ns>:<name> -n y (or --user=<user>). 3. Use a ClusterRole plus ClusterRoleBinding only for genuinely cluster-wide needs; a ClusterRole bound with a RoleBinding grants it only within that namespace, which is often what you want. 4. Get the API group right: use kubectl api-resources to see each resource's group (pods: core ''; deployments: apps; ingresses: networking.k8s.io). 5. Make sure the pod actually uses the service account you bound (spec.serviceAccountName), and avoid binding cluster-admin to fix a permission error. Verify: kubectl auth can-i <verb> <resource> -n <ns> --as <subject> returns yes, and the original command works. Sources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/ https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/