Skip to main content
HTTP 403 Forbidden

Kubernetes RBAC forbidden

The request was authenticated, but the active authoriser did not permit the requested verb, resource and scope.

Kubernetes API server authorisationAuthorisationhigh
Exact message
User cannot get resource in API group at the cluster scope

Also searched as: Forbidden · RBAC access denied

What it means

The identity lacks an applicable RoleBinding or ClusterRoleBinding, the rule uses the wrong API group or resource, or the caller is not the identity operators expect.

Typical trigger conditions

  • Missing binding
  • Namespaced Role used for a cluster-scoped resource
  • Wrong ServiceAccount
  • Rule omits the requested verb, subresource or API group
Evidence before intervention

First diagnostic checks

1

Capture the full denial

The response identifies the evaluated user, verb, resource, API group and namespace or cluster scope.

2

Ask the authoriser

Test the exact action as the relevant identity where impersonation is permitted.

kubectl auth can-i <verb> <resource> --as=<identity> -n <namespace>
3

Trace bindings

Inspect RoleBindings and ClusterRoleBindings that select the user, group or ServiceAccount.

Version and platform notes

RBAC APIs are stable; available resources and subresources depend on installed API groups and cluster version.

Continue the investigation

Engineering signal

Follow Kubernetes failures and fixes

One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.