Kubernetes "Error from server (Forbidden)" RBAC clusterrole in CI - Fix it

By Kaveh Alemi·Latchkey

403 Forbidden means authentication succeeded but authorization failed: the identity (a CI ServiceAccount or IAM-mapped user) lacks an RBAC rule for the verb/resource. The message names exactly who cannot do what.

What this error means

kubectl fails with Error from server (Forbidden): <resource> is forbidden: User "<id>" cannot <verb> resource "<res>" in API group "<grp>" at the cluster scope.

kubectl

Error from server (Forbidden): deployments.apps is forbidden: User
"system:serviceaccount:ci:deployer" cannot create resource "deployments" in
API group "apps" in the namespace "prod"

Common causes

Missing RBAC rule

No Role/ClusterRole grants the verb+resource the identity is attempting (e.g. create deployments in a namespace).

Binding scoped wrong

The permission exists but the (Cluster)RoleBinding targets a different namespace, subject, or scope than the CI identity.

How to fix it

Confirm the missing permission

Use auth can-i to verify exactly what is denied.

Terminal

kubectl auth can-i create deployments -n prod \
  --as system:serviceaccount:ci:deployer
kubectl describe clusterrolebinding | grep -i deployer

Grant least-privilege RBAC

Create/adjust a Role (namespaced) or ClusterRole with the needed verbs+resources.
Bind it to the CI ServiceAccount/identity with a RoleBinding/ClusterRoleBinding in the right scope.
Re-run; this is an authorization fix, not something a retry resolves.

How to prevent it

Define the CI deployer RBAC as code and review changes.
Grant least privilege per namespace, not blanket cluster-admin.
Test kubectl auth can-i for the deploy actions in CI.

Frequently asked questions

What causes ""Error from server (Forbidden)""?