title: Calico based pod is not coming up
body: <p>I am setting up a pod using calico but it keeps on failing with some authorization error. By default following is the node cidr of my system:</p>
  <pre class="lang-sh prettyprint-override"><code>[root@k8master-1 ~]# kubeadm config view | grep Subnet
    podSubnet: 10.244.0.0/16
    serviceSubnet: 10.96.0.0/12
  </code></pre>
  <p>I have set up the ippools using the following steps:</p>
  <p><a href="https://docs.projectcalico.org/getting-started/kubernetes/flannel/flannel" rel="nofollow noreferrer">https://docs.projectcalico.org/getting-started/kubernetes/flannel/flannel</a></p>
  <h3>IP Pool creation</h3>
  <pre class="lang-yaml prettyprint-override"><code>- apiVersion: projectcalico.org/v3
    kind: IPPool
    metadata:
      name: rack-ip-pool 
    spec:
      blockSize: 26
      cidr: 10.244.1.0/24
      ipipMode: Never
      natOutgoing: true
      nodeSelector: all()
      vxlanMode: Never
  </code></pre>
  <h3>Ip Pool List</h3>
  <pre class="lang-sh prettyprint-override"><code>[root@k8master-1 ~]# calicoctl get ippool -o wide
  NAME          CIDR            NAT    IPIPMODE   VXLANMODE   DISABLED   SELECTOR   
  rack-ip-pool   10.244.1.0/24   true   Never      Never       false      all()   
  </code></pre>
  Pod Yaml
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: testcalico
    labels:
      cracklerack: &quot;1&quot;
  spec:
    serviceName: testcalico-svc
    selector:
      matchLabels:
        cracklerack: &quot;1&quot;
    template:
      metadata:
        labels:
          cracklerack: &quot;1&quot;
        annotations:
         cni.projectcalico.org/ipv4pools: &quot;[\&quot;rack-ip-pool\&quot;]&quot;
      spec:
        runtimeClassName: kata-containers
        containers:
        - name: testcalico
          image: cracklelinux:7
          ports:
          - containerPort: 80
          command: [/usr/sbin/init]
          securityContext:
            privileged: true
  ---
  apiVersion: v1
  kind: Service
  metadata:
   name: testcalico-svc
  spec:
   clusterIP: None
   selector:
     cracklerack: &quot;1&quot;
  </code></pre>
  <p>When I create a pod, it throws the following error:</p>
  <h3>Error</h3>
  <pre class="lang-sh prettyprint-override"><code> Warning  FailedCreatePodSandBox  112s  kubelet, k8worker-1  Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod network sandbox k8s_xxxxx-0_default_45357eab-bf40-4fe7-a470-da42c9668116_0(579e2c258154fcdc2e85df4a1e35264ea9550b0dd1c4384331abc471f552456d): connection is unauthorized: ipamconfigs.crd.projectcalico.org &quot;default&quot; is forbidden: User &quot;system:serviceaccount:kube-system:canal&quot; cannot get resource &quot;ipamconfigs&quot; in API group &quot;crd.projectcalico.org&quot; at the cluster scope
  </code></pre>