k8s 的服务账户绑定角色后仍然没有权限

就创建了一个简单的角色绑定了服务账户 sa1 ，然后在 pod 内测试访问，没权限； 以下是现场，有无老哥帮忙看一下

$ kubectl describe role pod-reader      
Name:         pod-reader
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  pods       []                 []              [get watch list]

# Focusing on [sa1]
$ kubectl describe rolebinding read-pods  
Name:         read-pods
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  pod-reader
Subjects:
  Kind            Name   Namespace
  ----            ----   ---------
  User            user2  
  User            user3  
  ServiceAccount  sa1   

$ cat pod_associate_serviceaccount.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: nginx-sa-longtime
  labels:
    app: nginx
spec:
  serviceAccountName: sa1
  containers:
    - name: nginx-container
      image: nginx

# Enter container to test with curl, got 403
$ kubectl exec -it nginx-sa-longtime -- bash   
root@nginx-sa-longtime:/# TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
root@nginx-sa-longtime:/# CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
root@nginx-sa-longtime:/# curl --cacert $CACERT --header "Authorization: Bearer $TOKEN" https://kubernetes.default.svc.cluster.local/api/v1/namespaces/defaut/pods
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "pods is forbidden: User \"system:serviceaccount:default:sa1\" cannot list resource \"pods\" in API group \"\" in the namespace \"defaut\"",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403
}