kubernetes rbac_error ai_generated partial

Error from server (Forbidden): clusterroles.rbac.authorization.k8s.io is forbidden

ID: kubernetes/clusterrole-forbidden

Also available as: JSON · Markdown
82%Fix Rate
85%Confidence
50Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
8 active — — —

Root Cause

Insufficient RBAC permissions. User/service account can't create cluster-scoped resources.

generic

Workarounds

  1. 92% success Create a ClusterRole and ClusterRoleBinding with specific permissions 
    kubectl create clusterrolebinding my-binding --clusterrole=<role> --serviceaccount=<ns>:<sa>

    Sources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrolebinding-example

  2. 88% success Use namespaced Role instead of ClusterRole if possible (more restricted scope) 
    more restricted scope

    Sources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole

  3. 85% success Check current permissions: kubectl auth can-i --list 
    kubectl auth can-i --list

    Sources: https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access

Dead Ends

Common approaches that don't work:

  1. Give cluster-admin role to the service account 75% fail

    Overly permissive — principle of least privilege

  2. Disable RBAC 95% fail

    Removes all authorization — anyone can do anything

Error Chain

Frequently confused with: