How to fix RoleBinding not found in Kubernetes

What this error means

A RoleBinding is a Kubernetes resource that grants permissions (defined in a Role or ClusterRole) to users, groups, or service accounts. When Kubernetes cannot find a RoleBinding, it usually means the binding object was never created, was created in the wrong namespace, or was deleted. RoleBindings are namespace-scoped resources, so a RoleBinding in the default namespace is invisible to pods in other namespaces. This error often occurs during pod startup when the kubelet tries to validate RBAC permissions using a RoleBinding that doesn't exist, or when kubectl commands reference a non-existent binding. Unlike "Permission denied" errors (which mean a binding exists but lacks required permissions), "not found" means the binding itself is missing.

Typical symptoms

• kubectl get rolebinding returns the binding in one namespace, but pods in another namespace cannot use it
• kubectl auth can-i command shows RBAC failure because the RoleBinding doesn't exist
• Pod startup fails silently or with vague permission errors, then succeeds after manually creating the RoleBinding
• Service account can't access resources even though admin verified the RoleBinding was created
• Different namespaces report different permission behavior for the same service account
• kubectl describe rolebinding returns "not found" when explicitly checking
• Helm deployments fail to grant service account permissions until Helm charts are manually edited

Common causes

1. RoleBinding created in default namespace, but pod uses a service account in a different namespace
2. RoleBinding name typo or mismatch between what kubectl expects and what was created
3. RoleBinding deleted by accident or by a cleanup script, but pods still expect it to exist
4. RoleBinding never created, only the Role or ClusterRole exists without a corresponding binding
5. Using RoleBinding with a ClusterRole in wrong namespace (should use ClusterRoleBinding for cluster-wide access)
6. Infrastructure-as-Code (Terraform, Helm, Kustomize) creates resources out of order, binding before Role exists
7. Service account created in namespace A, but RoleBinding created in namespace B

How to fix "RoleBinding not found"

# View pod events
kubectl describe pod <pod-name> -n <namespace>

# Check recent events in the namespace
kubectl get events -n <namespace> --sort-by=.metadata.creationTimestamp | tail -20

# If using RBAC audit, check API server logs
kubectl logs -n kube-system -l component=kube-apiserver | grep RBAC

# List RoleBindings in current namespace
kubectl get rolebinding -n <namespace>

# List all RoleBindings across all namespaces
kubectl get rolebinding -A

# Check if a specific RoleBinding exists
kubectl get rolebinding <rolebinding-name> -n <namespace>

# List all Roles in the namespace
kubectl get role -n <namespace>

# View the Role definition
kubectl get role <role-name> -n <namespace> -o yaml

kubectl create rolebinding <rolebinding-name> \
  --clusterrole=<role-name> \
  --serviceaccount=<namespace>:<service-account-name> \
  -n <namespace>

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-rolebinding
  namespace: my-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: my-role
subjects:
- kind: ServiceAccount
  name: my-service-account
  namespace: my-namespace

kubectl apply -f rolebinding.yaml

# BAD: RoleBinding created first, then Role
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-binding
roleRef:
  kind: Role
  name: my-role  # This role doesn't exist yet!
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-role
rules:
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list]

# GOOD: Role created first
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-role
rules:
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-binding
roleRef:
  kind: Role
  name: my-role
subjects:
- kind: ServiceAccount
  name: default

# Find which namespace your service account is in
kubectl get serviceaccount -A | grep <service-account-name>

# List RoleBindings in that same namespace
kubectl get rolebinding -n <correct-namespace>

# Service account in "app" namespace
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: app
---
# RoleBinding must ALSO be in "app" namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-reader
  namespace: app  # SAME namespace!
roleRef:
  kind: Role
  name: pod-reader
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: app

# This only grants permissions in the current namespace
kubectl create rolebinding my-binding \
  --clusterrole=view \
  --serviceaccount=default:default \
  -n default

# For cluster-wide access, use ClusterRoleBinding
kubectl create clusterrolebinding my-cluster-binding \
  --clusterrole=view \
  --serviceaccount=default:default

# Test if service account can perform an action
kubectl auth can-i get pods \
  --as=system:serviceaccount:<namespace>:<service-account-name> \
  -n <namespace>

# Expected output
yes  # Permissions granted
# or
no   # Permissions still not granted

# View detailed RBAC decision
kubectl auth can-i get pods \
  --as=system:serviceaccount:default:my-sa \
  -n default \
  --record

Advanced notes

Frequently asked questions

What does "RoleBinding not found" mean?

A RoleBinding is a Kubernetes resource that grants permissions (defined in a Role or ClusterRole) to users, groups, or service accounts. When Kubernetes cannot find a RoleBinding, it usually means the binding object was never created, was created in the wrong namespace, or was deleted. RoleBindings are namespace-scoped resources, so a RoleBinding in the default namespace is invisible to pods in other namespaces.

How do I fix "RoleBinding not found"?

The RoleBinding referenced by your pod or service account does not exist. Fix by ensuring the RoleBinding is created in the correct namespace, verify its name matches what's referenced, and confirm the Role it points to exists before the RoleBinding.

What causes "RoleBinding not found"?

RoleBinding created in default namespace, but pod uses a service account in a different namespace RoleBinding name typo or mismatch between what kubectl expects and what was created RoleBinding deleted by accident or by a cleanup script, but pods still expect it to exist

Is the "RoleBinding not found" error serious?

It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Related errors

• Waiting for rollout to finish

  How to fix "Waiting for rollout to finish" in Kubernetes

  HIGH

• rpc error: code = 2 desc = repository does not exist or no pull access

  How to fix "Repository not found" in Kubernetes

  HIGH

• running as root not allowed

  How to fix "run as root not allowed" in Kubernetes

  MEDIUM

• ReplicaSet has timed out progressing

  How to fix "ReplicaSet has timed out progressing" in Kubernetes

  HIGH

• upstream connect error or disconnect/reset before headers. reset reason: overflow

  How to fix "upstream connect error or disconnect/reset before headers" in Kubernetes

  HIGH

• ArgoCD degraded

  How to fix "ArgoCD degraded" in Kubernetes

  HIGH

Official resources & further reading

• 📚Kubernetes Official Documentation
• 📖
  Kubernetes Docs: rbac(Official Docs)
• 📖
  Kubernetes Docs: role binding v1(Official Docs)
• 📖
  Kubernetes Docs: kubectl_create_rolebinding(Official Docs)
• 📖
  Kubernetes Docs: rbac good practices(Official Docs)
• 📝
  kubernetes.io: inspect kubernetes audit logs