A pod within the Deployment named buffalo-deployment and in namespace gorilla is logging errors. 1) Look at the logs identify errors messages. Find errors, including User…

This question tests Kubernetes RBAC (Role-Based Access Control) by requiring you to diagnose a permission error from pod logs and fix it by granting the pod's service account the necessary API permissions via a Role and RoleBinding.

Submitted by thandi_sa· May 4, 2026Application Environment, Configuration and Security

Question

A pod within the Deployment named buffalo-deployment and in namespace gorilla is logging errors. 1) Look at the logs identify errors messages. Find errors, including User "system:serviceaccount:gorilla:default" cannot list resource "deployment" [...] in the namespace "gorilla" 2) Update the Deployment buffalo-deployment to resolve the errors in the logs of the Pod. The buffalo-deployment 'S manifest can be found at -/prompt/escargot/buffalo-deployment.yaml

Explanation

Approach. The error message 'system:serviceaccount:gorilla:default cannot list resource deployment in namespace gorilla' tells you exactly what is missing: the default service account in the gorilla namespace lacks RBAC permission to list Deployment resources. The correct fix is three steps: (1) Create a Role in the gorilla namespace that grants 'list' (and likely 'get'/'watch') verbs on the 'deployments' resource in the 'apps' API group. (2) Create a RoleBinding in gorilla that binds that Role to the subject 'system:serviceaccount:gorilla:default'. (3) If the buffalo-deployment.yaml manifest does not already reference the default service account explicitly, it may not need changing - but you should verify the manifest's serviceAccountName field and apply any required updates with kubectl apply -f ~/prompt/escargot/buffalo-deployment.yaml. The Role and RoleBinding must be namespace-scoped (not ClusterRole/ClusterRoleBinding) since the error is namespace-specific.

Concept tested. Kubernetes RBAC - diagnosing ServiceAccount permission errors from pod logs and resolving them by creating a namespace-scoped Role and RoleBinding to grant the required API resource access.

Reference. https://kubernetes.io/docs/reference/access-authn-authz/rbac/

Topics

#RBAC#ServiceAccounts#Troubleshooting#Deployments

Community Discussion

No community discussion yet for this question.

Full CKAD Practice