Error from server (Forbidden): pods is forbidden: User cannot perform this action

Workarounds

1. 95% success Create a Role with the specific verbs and resources needed

   kubectl create role pod-reader --verb=get,list,watch --resource=pods -n my-namespace
   kubectl create rolebinding pod-reader-binding --role=pod-reader --serviceaccount=my-namespace:my-sa -n my-namespace

   Sources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

2. 92% success Bind a ClusterRole or Role to the service account

   # For namespace-scoped access:
   kubectl create rolebinding my-binding \
     --clusterrole=view \
     --serviceaccount=default:my-sa \
     -n my-namespace
   
   # For cluster-wide access:
   kubectl create clusterrolebinding my-binding \
     --clusterrole=view \
     --serviceaccount=default:my-sa
   
   # Use built-in ClusterRoles: view (read-only), edit (read-write), admin (full namespace access).

   Sources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

3. 88% success Use kubectl auth can-i to test permissions before applying

   # Test if current user can perform an action:
   kubectl auth can-i create pods -n my-namespace
   
   # Test as a specific service account:
   kubectl auth can-i list deployments --as=system:serviceaccount:default:my-sa
   
   # List all permissions for a service account:
   kubectl auth can-i --list --as=system:serviceaccount:default:my-sa

   Sources: https://kubernetes.io/docs/reference/access-authn-authz/authorization/