Let's say I have a service account bound to a read-only role in some namespace ns1.

How can I get this token/user/ServiceAccount to namespace mapping, just by using kubectl or using REST calls to the API server? Put simply, I want to answer this question - Which namespace does this ServiceAccount belong to?

If I use the token bound to this service account to make REST API calls to get namespaces, it gives me a 403 Forbidden. I can be the admin and list all namespaces however, I cannot figure out the mapping in the question. Thanks!