title: ServiceAccount cannot list resource "pods" in namespace though it has role with appropriate resources
body: <p>I have the following definitions in my custom namespace:</p>
  
  <pre><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: test-sa
  ---
  kind: Role
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: test
  rules:
    - apiGroups: [""]
      resources: ["pods", "pods/exec"]
      verbs: ["get", "list", "delete", "patch", "create"]
    - apiGroups: ["extensions", "apps"]
      resources: ["deployments", "deployments/scale"]
      verbs: ["get", "list", "delete", "patch", "create"]
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: test
  subjects:
    - kind: User
      name: test-sa
      apiGroup: rbac.authorization.k8s.io
  roleRef:
    kind: Role
    name: test
    apiGroup: rbac.authorization.k8s.io
  </code></pre>
  
  <p>Running <code>describe role test</code></p>
  
  <pre><code>Name:         test
  Labels:       &lt;none&gt;
  Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                  {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"test","namespace":"test-namesapce...
  PolicyRule:
    Resources                     Non-Resource URLs  Resource Names  Verbs
    ---------                     -----------------  --------------  -----
    pods/exec                     []                 []              [get list delete patch create]
    pods                          []                 []              [get list delete patch create]
    deployments.apps/scale        []                 []              [get list delete patch create]
    deployments.apps              []                 []              [get list delete patch create]
    deployments.extensions/scale  []                 []              [get list delete patch create]
    deployments.extensions        []                 []              [get list delete patch create]
  </code></pre>
  
  <p>When I'm trying to run the command <code>kubectl get pods</code> in a pod that is using this service account, I'm getting the following error:</p>
  
  <blockquote>
    <p>Error from server (Forbidden): pods is forbidden: User
    "system:serviceaccount:test-namespace:test-sa" cannot list resource
    "pods" in API group "" in the namespace "test-namespace"</p>
  </blockquote>
  
  <p>Where is that misconfigured?</p>