title: kubernetes api: Failure 403 pods is forbidden: User "system:serviceaccount:default:journalbeat" cannot list resource "pods" in API group ""
body: <p>Not sure what is wrong here as I have given the correct privileges but still getting forbidden error.</p>
  <p>I am using following yamls for ClusterRole, ClusterRoleBinding and ServiceAccount.</p>
  <h2>ClusterRole</h2>
  <pre class="lang-yaml prettyprint-override"><code>
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: journalbeat
  rules:
    - apiGroups:
        - extensions
      resourceNames:
        - journalbeat
      resources:
        - podsecuritypolicies
      verbs:
        - use
    - apiGroups:
        - &quot;&quot;
      resources:
        - namespaces
        - pods
      verbs:
        - get
        - watch
        - list
  
  </code></pre>
  <h2>Rolebinding.yaml</h2>
  <pre class="lang-yaml prettyprint-override"><code>
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: journalbeat
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: journalbeat
  subjects:
    - kind: ServiceAccount
      name: journalbeat
      namespace: journalbeat
  </code></pre>
  <h2>ServiceAccount</h2>
  <pre class="lang-yaml prettyprint-override"><code>
  ---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: journalbeat
  </code></pre>
  <ul>
  <li>Error log for journalbeat pod</li>
  </ul>
  <pre class="lang-sh prettyprint-override"><code>$ kubectl logs -f journalbeat-4thzj                
  2020-06-24T06:30:34.947Z        INFO    instance/beat.go:606    Home path: [/usr/share/journalbeat] Config path: [/usr/share/journalbeat] Data path: [/usr/share/journalbeat/data] Logs path: [/usr/share/journalbeat/logs]
  2020-06-24T06:30:34.952Z        INFO    instance/beat.go:614    Beat ID: dd2ed096-8ad0-4e7d-86f8-340acfcddd1d
  2020-06-24T06:30:34.953Z        INFO    kubernetes/util.go:71   kubernetes: Using node ip-172-28-20-76 provided in the config
  2020-06-24T06:30:34.953Z        INFO    kubernetes/watcher.go:182       kubernetes: Performing a resource sync for *v1.PodList
  2020-06-24T06:30:34.961Z        ERROR   kubernetes/watcher.go:185       kubernetes: Performing a resource sync err kubernetes api: Failure 403 pods is forbidden: User &quot;system:serviceaccount:default:journalbeat&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; at the cluster scope for *v1.PodList
  2020-06-24T06:30:34.961Z        INFO    instance/beat.go:366    journalbeat stopped.
  2020-06-24T06:30:34.961Z        ERROR   instance/beat.go:877    Exiting: error initializing processors: kubernetes api: Failure 403 pods is forbidden: User &quot;system:serviceaccount:default:journalbeat&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; at the cluster scope
  Exiting: error initializing processors: kubernetes api: Failure 403 pods is forbidden: User &quot;system:serviceaccount:default:journalbeat&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; at the cluster scope
  
  </code></pre>
  <p>Also</p>
  <pre class="lang-sh prettyprint-override"><code>$ kubectl auth can-i get pods --as system:serviceaccount:default:journalbeat
  no
  
  </code></pre>