title: Service account role bindings not working for API access
body: <p>I am working on developing tools to interact with Kubernetes. I have OpenShift setup with the allow all authentication provider. I can log into the web console as I would expect.</p>
  
  <p>I have also been able to setup a service account and assign a cluster role binding to the service account user. Despite this, when I access the REST API using a token of that service account, I get forbidden. </p>
  
  <p>Here is what happens when I try to setup role bindings via OpenShift commands:</p>
  
  <pre><code>[root@host1 ~]# oadm policy add-cluster-role-to-user view em7 --namespace=default
  [root@host1 ~]# oadm policy add-cluster-role-to-user cluster-admin em7 --namespace=default
  [root@host1 ~]# oadm policy add-cluster-role-to-user cluster-reader em7 --namespace=default
  
  
  [root@host1 ~]# oc get secrets | grep em7
  em7-dockercfg-hnl6m         kubernetes.io/dockercfg               1         18h
  em7-token-g9ujh             kubernetes.io/service-account-token   4         18h
  em7-token-rgsbz             kubernetes.io/service-account-token   4         18h
  
  
  TOKEN=`oc describe secret em7-token-g9ujh | grep token: | awk '{ print $2 }'`
  
  
  [root@host1 ~]# curl -kD - -H "Authorization: Bearer $TOKEN" https://localhost:8443/api/v1/pods
  HTTP/1.1 403 Forbidden
  Cache-Control: no-store
  Content-Type: application/json
  Date: Tue, 19 Jun 2018 15:36:40 GMT
  Content-Length: 260
  
  {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "User \"system:serviceaccount:default:em7\" cannot list all pods in the cluster",
    "reason": "Forbidden",
    "details": {
      "kind": "pods"
    },
    "code": 403
  }
  </code></pre>
  
  <p>I can also try using the yaml file from (<a href="https://stackoverflow.com/questions/49667239/openshift-admin-token">Openshift Admin Token</a>):
      # creates the service account "ns-reader"
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: ns-reader
        namespace: default</p>
  
  <pre><code>---
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    # "namespace" omitted since ClusterRoles are not namespaced
    name: global-reader
  rules:
  - apiGroups: [""]
    # add other rescources you wish to read
    resources: ["pods", "secrets"]
    verbs: ["get", "watch", "list"]
  
  ---
  # This cluster role binding allows service account "ns-reader" to read pods in all available namespace
  kind: ClusterRoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: read-ns
  subjects:
  - kind: ServiceAccount
    name: ns-reader
    namespace: default
  roleRef:
    kind: ClusterRole
    name: global-reader
    apiGroup: rbac.authorization.k8s.io
  </code></pre>
  
  <p>When I run this, I get the following error:</p>
  
  <pre><code>[root@host1 ~]# kubectl create -f stack_overflow_49667238.yaml
  error validating "stack_overflow_49667238.yaml": error validating data: API version "rbac.authorization.k8s.io/v1" isn't supported, only supports API versions ["federation/v1beta1" "v1" "authentication.k8s.io/v1beta1" "componentconfig/v1alpha1" "policy/v1alpha1" "rbac.authorization.k8s.io/v1alpha1" "apps/v1alpha1" "authorization.k8s.io/v1beta1" "autoscaling/v1" "extensions/v1beta1" "batch/v1" "batch/v2alpha1"]; if you choose to ignore these errors, turn validation off with --validate=false
  </code></pre>
  
  <p>I have tried several different API versions from the list but they all failed in a similar way.</p>