How to fix User cannot get resource in Kubernetes

KubernetesINTERMEDIATEMEDIUM

This RBAC error occurs when a user lacks permission to access a resource. Fix it by creating a Role or ClusterRole with required permissions and binding it to the user with RoleBinding or ClusterRoleBinding.

What this error means

The "User cannot get resource" error (typically shown as "Error from server (Forbidden): {resource} is forbidden: User cannot {verb} resource") indicates that Kubernetes RBAC (Role-Based Access Control) is blocking the request. The authenticated user doesn't have permission to perform the requested action on the specified resource. Kubernetes RBAC uses four main objects: Roles (namespace-scoped permissions), ClusterRoles (cluster-wide permissions), RoleBindings (grant Role to users in a namespace), and ClusterRoleBindings (grant ClusterRole cluster-wide). A user must have an appropriate binding to a role that includes the required verb and resource. This error commonly occurs when users are added to a cluster without proper role assignments, when accessing resources in namespaces where they lack bindings, or when the role doesn't include all necessary verbs (get, list, watch, create, update, delete).

How to fix "User cannot get resource"

1Check current user and test permissions

Verify who you are and what permissions you have:

bash

# Check current user
kubectl auth whoami

# Test specific permission
kubectl auth can-i get pods
kubectl auth can-i get pods -n production

# Test as another user
kubectl auth can-i get pods --as=john.developer

# List all permissions for a user
kubectl auth can-i --list --as=john.developer

Response is "yes" or "no".

2Inspect existing roles and bindings

Find what roles and bindings exist:

bash

# List roles in namespace
kubectl get roles -n default

# Describe a role
kubectl describe role pod-reader -n default

# List role bindings
kubectl get rolebindings -n default

# Find bindings for a specific user
kubectl get rolebindings,clusterrolebindings --all-namespaces -o json | \
  jq '.items[] | select(.subjects[]?.name=="john.developer")'

3Create a Role with required permissions

Create a namespace-scoped Role:

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]           # Core API (pods, services, secrets)
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]       # Apps API (deployments, statefulsets)
  resources: ["deployments"]
  verbs: ["get", "list"]

Common apiGroups:
- "" (empty): pods, services, configmaps, secrets
- "apps": deployments, statefulsets, daemonsets
- "batch": jobs, cronjobs
- "networking.k8s.io": networkpolicies

4Create RoleBinding to grant permissions

Bind the role to the user:

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader-binding
  namespace: default
subjects:
- kind: User
  name: john.developer
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Apply and verify:

bash

kubectl apply -f rolebinding.yaml
kubectl auth can-i get pods --as=john.developer -n default

5Use ClusterRole for cluster-wide access

For access across all namespaces:

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader-global
rules:
- apiGroups: [""]
  resources: ["pods", "namespaces"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pod-reader-global-binding
subjects:
- kind: User
  name: john.developer
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: pod-reader-global
  apiGroup: rbac.authorization.k8s.io

6Verify fix and test access

Confirm permissions are working:

bash

# Test permission
kubectl auth can-i get pods --as=john.developer -n default

# Try the actual command
kubectl get pods -n default

# Test multiple verbs
kubectl auth can-i list pods --as=john.developer
kubectl auth can-i create pods --as=john.developer
kubectl auth can-i delete pods --as=john.developer

All required verbs should return "yes".

How to fix User cannot get resource in Kubernetes

What this error means

Typical symptoms

Common causes

How to fix "User cannot get resource"

Advanced notes

Related errors

Official resources & further reading