kubernetes rbac ai_generated true

Error from server (Forbidden): pods is forbidden: User 'system:serviceaccount:default:default' cannot list resource 'pods'

ID: kubernetes/forbidden-user

Also available as: JSON · Markdown
94%Fix Rate
96%Confidence
50Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
8 active — — —

Root Cause

Service account or user lacks RBAC permissions for the requested operation.

generic

Workarounds

  1. 95% success Create a Role and RoleBinding with the specific permissions needed 
    kubectl create role pod-reader --verb=get,list --resource=pods

    Sources: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

  2. 90% success Use ClusterRole for cluster-wide access or Role for namespace-scoped access 
    Match the scope of permissions to the actual need

Dead Ends

Common approaches that don't work:

  1. Granting cluster-admin to the service account 85% fail

    Excessive permissions; violates principle of least privilege

  2. Disabling RBAC 95% fail

    Removes all access control from the cluster

Error Chain

Frequently confused with: