You get "forbidden: User cannot list resource" in Kubernetes. What is wrong?
⚡
Quick Answer
An RBAC authorization failure — the user or service account lacks a Role/ClusterRole granting that verb on that resource. Fix by binding an appropriate (least-privilege) Role via a RoleBinding/ClusterRoleBinding.
Detailed Answer
The error names the subject, verb, and resource. Diagnose with kubectl auth can-i <verb> <resource> --as <user>. Then create or bind a Role/ClusterRole that allows exactly the needed verbs on the needed resources (least privilege), and confirm the binding references the correct subject (user, group, or serviceAccount). Avoid granting cluster-admin as a shortcut.
Code Example
kubectl auth can-i list pods --as system:serviceaccount:default:myapp kubectl describe rolebinding,clusterrolebinding -A | grep <subject>
💡
Interview Tip
Reach for kubectl auth can-i to reproduce, and stress least-privilege Roles over cluster-admin.
kubernetesrbacforbiddentroubleshooting