Your app needs to talk to the Kubernetes API. But by default, pods can't do much - you have to grant permissions explicitly.
A monitoring application needs to list pods in its namespace. The app uses a dedicated ServiceAccount, but it has no permissions. When the app tries to list pods, it gets "Forbidden" errors.
Start this challenge in your local Kubernetes cluster:
