Kubernetes RBAC forbidden
The request was authenticated, but the active authoriser did not permit the requested verb, resource and scope.
User cannot get resource in API group at the cluster scopeAlso searched as: Forbidden · RBAC access denied
What it means
The identity lacks an applicable RoleBinding or ClusterRoleBinding, the rule uses the wrong API group or resource, or the caller is not the identity operators expect.
Typical trigger conditions
- Missing binding
- Namespaced Role used for a cluster-scoped resource
- Wrong ServiceAccount
- Rule omits the requested verb, subresource or API group
First diagnostic checks
Capture the full denial
The response identifies the evaluated user, verb, resource, API group and namespace or cluster scope.
Ask the authoriser
Test the exact action as the relevant identity where impersonation is permitted.
kubectl auth can-i <verb> <resource> --as=<identity> -n <namespace>
Trace bindings
Inspect RoleBindings and ClusterRoleBindings that select the user, group or ServiceAccount.
Version and platform notes
RBAC APIs are stable; available resources and subresources depend on installed API groups and cluster version.
Continue the investigation
Follow Kubernetes failures and fixes
One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.