KubernetesはすべてのデフォルトのServiceAccountに権限を与えます.

環境準備:
プライベートなネーミングスペースmynamespaceを作成し、デフォルトのservice accountを使用するpodを作成します.

#cat mynamespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: mynamespace


#cat example-pod3.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-default-verbs
  namespace: mynamespace
spec:
  shareProcessNamespace: true
  containers:
  - name: shell
    image: radial/busyboxplus:curl
    stdin: true
    tty: true

なぜpodがミラー:radial/busyboxplus:curlを使用するのかは、curlコマンドを実行して検証を容易にするためです.
mynamespaceを表示すると2つのサービスaccountがあります

#kubectl get serviceaccount -n mynamespace
NAME         SECRETS   AGE
default      1         14h
example-sa   1         14h

#kubectl describe serviceaccount default -n mynamespace
Name:                default
Namespace:           mynamespace
Labels:              
Annotations:         
Image pull secrets:  
Mountable secrets:   default-token-sg9f6
Tokens:              default-token-sg9f6
Events:              

コンテナに入り、curlコマンドを実行してpodの権限を表示します.

#kubectl attach -it test-default-verbs -n mynamespace
$curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --header "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api/v1/namespaces/$(cat/var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "pods is forbidden: User \"system:serviceaccount:mynamespace:default\" cannot list resource \"pods\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403

結果はpods is forbidden:Userで、権限がないことを示します.
権限
次にdefaultの権限を変更して、defaultにlist podの権限を持たせます.権限ロールを追加してからdefaultのserviceaccountにロールを付与します

#cat example-clusterrole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: example-clusterrole
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]


#kubectl apply -f example-clusterrole.yaml
#kubectl describe clusterrole example-clusterrole
Name:         example-clusterrole
Labels:       
Annotations:  PolicyRule:
  Resources   Non-Resource URLs  Resource Names  Verbs
  ---------   -----------------  --------------  -----
  pods        []                 []              [get watch list]

次にclusterrolebindingを作成し、すべてのdefault serviceaccountにロールを追加します.

    #cat example-clusterrolebinding.yaml
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: example-clusterrolebinding
    subjects:
    - kind: Group
      name: system:serviceaccounts
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: example-clusterrole
      apiGroup: rbac.authorization.k8s.io
    #kubectl apply -f example-clusterrolebinding.yaml

    #kubectl describe clusterrolebinding example-clusterrolebinding
    Name:         example-clusterrolebinding
    Labels:       
    Annotations:  Role:
      Kind:       ClusterRole
      Name:       example-clusterrole
    Subjects:
      Kind   Name                    Namespace
      ----   ----                    ---------
      Group  system:serviceaccounts

再びコンテナに入り、curlコマンドを実行してすべてのpodを取得し、実行に成功しました

#kubectl attach -it test-default-verbs -n mynamespace
$curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --header "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api/v1/namespaces/$(cat/var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods
...
"imageID": "docker-pullable://radial/busyboxplus@sha256:a68c05ab1112fd90ad7b14985a48520e9d26dbbe00cb9c09aa79fdc0ef46b372",
            "containerID": "docker://d6b1a94caa364392ac7e3c07dd99faa1c80f15fe6f757aa54509ea778b6c93aa",
            "started": true
          }
        ],
        "qosClass": "BestEffort"
      }
    }
  ]