kubectl "Error from server (Forbidden): cannot create ... in the namespace" in CI - Fix it

By Kaveh Alemi·Latchkey

A Forbidden error is RBAC, not auth: the service account is recognized but has no Role or ClusterRole binding that allows the verb (create/patch/apply) on that resource in that namespace. The message names exactly which permission is missing.

What this error means

A kubectl apply step fails with Error from server (Forbidden): ... is forbidden: User "system:serviceaccount:ci:deployer" cannot create resource "deployments" in API group "apps" in the namespace "prod".

Error from server (Forbidden): error when creating "deploy.yaml":
deployments.apps is forbidden: User "system:serviceaccount:ci:deployer" cannot
create resource "deployments" in API group "apps" in the namespace "prod"

Common causes

No RoleBinding grants the needed verb

The CI service account has no Role/ClusterRole binding covering create/patch on that resource in the target namespace.

A binding scoped to the wrong namespace

The RoleBinding exists but in a different namespace, so it does not apply where the deploy runs.

How to fix it

Confirm the exact missing permission, then grant it

1. Use kubectl auth can-i as the deploy identity to confirm which verb/resource is denied.
2. Create a Role with the needed rules and a RoleBinding to the CI service account in the target namespace.
3. Re-run the deploy once the binding is applied.

kubectl auth can-i create deployments -n prod \
  --as system:serviceaccount:ci:deployer

Bind the deployer service account

Grant least-privilege rules in the namespace the pipeline deploys to.

kubectl create rolebinding ci-deployer \
  --clusterrole=edit \
  --serviceaccount=ci:deployer \
  --namespace=prod

How to prevent it

• Define the deploy RBAC as code and apply it alongside the cluster.
• Run kubectl auth can-i checks in CI before applying manifests.
• Scope bindings to the exact namespace and verbs the pipeline needs.

Frequently asked questions

Related guides

References

• Kubernetes documentation
• GitHub Actions documentation