How to fix User cannot get resource in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 7, 2025· 177 views

This RBAC error occurs when a user lacks permission to access a resource. Fix it by creating a Role or ClusterRole with required permissions and binding it to the user with RoleBinding or ClusterRoleBinding.

Quick fix

Fixes User cannot get resource

# Check current user
kubectl auth whoami

# Test specific permission
kubectl auth can-i get pods
kubectl auth can-i get pods -n production

# Test as another user
kubectl auth can-i get pods --as=john.developer

# List all permissions for a user
kubectl auth can-i --list --as=john.developer
  1. Check current user and test permissions
  2. Inspect existing roles and bindings
  3. Create a Role with required permissions
  4. Create RoleBinding to grant permissions
kubernetes — error
# Check current user
kubectl auth whoami
# Test specific permission
kubectl auth can-i get pods
kubectl auth can-i get pods -n production
# Test as another user
kubectl auth can-i get pods --as=john.developer
# List all permissions for a user
kubectl auth can-i --list --as=john.developer
User cannot get resource

What this error means

The "User cannot get resource" error (typically shown as "Error from server (Forbidden): {resource} is forbidden: User cannot {verb} resource") indicates that Kubernetes RBAC (Role-Based Access Control) is blocking the request. The authenticated user doesn't have permission to perform the requested action on the specified resource. Kubernetes RBAC uses four main objects: Roles (namespace-scoped permissions), ClusterRoles (cluster-wide permissions), RoleBindings (grant Role to users in a namespace), and ClusterRoleBindings (grant ClusterRole cluster-wide). A user must have an appropriate binding to a role that includes the required verb and resource. This error commonly occurs when users are added to a cluster without proper role assignments, when accessing resources in namespaces where they lack bindings, or when the role doesn't include all necessary verbs (get, list, watch, create, update, delete).

Typical symptoms

  • kubectl commands return "Error from server (Forbidden)"
  • User can access some resources but not others
  • Works in one namespace but not another
  • Works with --as=system:admin but not with actual user
  • Helm deployments fail with permission errors

Common causes

  1. User has no RoleBinding or ClusterRoleBinding
  2. Role doesn't include required verb (get, list, watch, etc.)
  3. Incorrect apiGroup in Role definition
  4. RoleBinding in wrong namespace (namespace-scoped access only)
  5. Using Role when ClusterRole is needed for cluster-wide access

How to fix "User cannot get resource"

1Check current user and test permissions

Verify who you are and what permissions you have:

bash
# Check current user
kubectl auth whoami

# Test specific permission
kubectl auth can-i get pods
kubectl auth can-i get pods -n production

# Test as another user
kubectl auth can-i get pods --as=john.developer

# List all permissions for a user
kubectl auth can-i --list --as=john.developer

Response is "yes" or "no".

2Inspect existing roles and bindings

Find what roles and bindings exist:

bash
# List roles in namespace
kubectl get roles -n default

# Describe a role
kubectl describe role pod-reader -n default

# List role bindings
kubectl get rolebindings -n default

# Find bindings for a specific user
kubectl get rolebindings,clusterrolebindings --all-namespaces -o json | \
  jq '.items[] | select(.subjects[]?.name=="john.developer")'
3Create a Role with required permissions

Create a namespace-scoped Role:

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]           # Core API (pods, services, secrets)
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]       # Apps API (deployments, statefulsets)
  resources: ["deployments"]
  verbs: ["get", "list"]

Common apiGroups:
- "" (empty): pods, services, configmaps, secrets
- "apps": deployments, statefulsets, daemonsets
- "batch": jobs, cronjobs
- "networking.k8s.io": networkpolicies

4Create RoleBinding to grant permissions

Bind the role to the user:

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader-binding
  namespace: default
subjects:
- kind: User
  name: john.developer
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Apply and verify:

bash
kubectl apply -f rolebinding.yaml
kubectl auth can-i get pods --as=john.developer -n default
5Use ClusterRole for cluster-wide access

For access across all namespaces:

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader-global
rules:
- apiGroups: [""]
  resources: ["pods", "namespaces"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pod-reader-global-binding
subjects:
- kind: User
  name: john.developer
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: pod-reader-global
  apiGroup: rbac.authorization.k8s.io
6Verify fix and test access

Confirm permissions are working:

bash
# Test permission
kubectl auth can-i get pods --as=john.developer -n default

# Try the actual command
kubectl get pods -n default

# Test multiple verbs
kubectl auth can-i list pods --as=john.developer
kubectl auth can-i create pods --as=john.developer
kubectl auth can-i delete pods --as=john.developer

All required verbs should return "yes".

Advanced notes

Role Aggregation (Kubernetes 1.9+):
Compose permissions from multiple roles using labels:

yaml
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.authorization.k8s.io/aggregate-to-viewer: "true"

Impersonation for testing:

bash
kubectl auth can-i get pods --as=jane.developer
kubectl get pods --as=system:serviceaccount:default:webapp

Privilege Escalation Prevention: You can only create roles/bindings with permissions you already possess.

Common Role Templates:
- Pod reader: verbs: ["get", "list"] on resources: ["pods"]
- Deployment manager: verbs: ["get", "list", "create", "update", "patch"] on resources: ["deployments"]
- Read-only all: verbs: ["get", "list", "watch"] on resources: ["*"]

Frequently asked questions

What does "User cannot get resource" mean?
The "User cannot get resource" error (typically shown as "Error from server (Forbidden): {resource} is forbidden: User cannot {verb} resource") indicates that Kubernetes RBAC (Role-Based Access Control) is blocking the request. The authenticated user doesn't have permission to perform the requested action on the specified resource. Kubernetes RBAC uses four main objects: Roles (namespace-scoped permissions), ClusterRoles (cluster-wide permissions), RoleBindings (grant Role to users in a namespace), and ClusterRoleBindings (grant ClusterRole cluster-wide).
How do I fix "User cannot get resource"?
This RBAC error occurs when a user lacks permission to access a resource. Fix it by creating a Role or ClusterRole with required permissions and binding it to the user with RoleBinding or ClusterRoleBinding.
What causes "User cannot get resource"?
User has no RoleBinding or ClusterRoleBinding Role doesn't include required verb (get, list, watch, etc.) Incorrect apiGroup in Role definition
Is the "User cannot get resource" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading