title: kubernetes pods/nodes is forbidden
body: <p>I'm using kubernetes on-prem</p>
  <p>While I build gitlab using kubernetes has some problem.
  I think it's related with serviceaccount or role-binding.
  but couldn't find correct way</p>
  <p>I found these posts</p>
  <p><a href="https://stackoverflow.com/questions/47973570/kubernetes-log-user-systemserviceaccountdefaultdefault-cannot-get-services">Kubernetes log, User &quot;system:serviceaccount:default:default&quot; cannot get services in the namespace</a></p>
  <p><a href="https://github.com/kubernetes/kops/issues/3551" rel="noreferrer">https://github.com/kubernetes/kops/issues/3551</a></p>
  <h1>my error logs</h1>
  <pre><code>==&gt; /var/log/gitlab/prometheus/current &lt;==
  2018-12-24_03:06:08.88786 level=error ts=2018-12-24T03:06:08.887812767Z caller=main.go:240 component=k8s_client_runtime err=&quot;github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:372: Failed to list *v1.Node: nodes is forbidden: User \&quot;system:serviceaccount:default:default\&quot; cannot list resource \&quot;nodes\&quot; in API group \&quot;\&quot; at the cluster scope&quot;
  2018-12-24_03:06:08.89075 level=error ts=2018-12-24T03:06:08.890719525Z caller=main.go:240 component=k8s_client_runtime err=&quot;github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:320: Failed to list *v1.Pod: pods is forbidden: User \&quot;system:serviceaccount:default:default\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; at the cluster scope&quot;
  </code></pre>