k8s-rbac-troubleshooting
Use when a Kubernetes request is refused by RBAC: "Error from server (Forbidden)", "User ... cannot list resource ... in the namespace" or "at the cluster scope", a ServiceAccount, controller, CI job or person getting 403, a RoleBinding that does not seem to apply (wrong namespace, wrong subject, a ClusterRole bound with a RoleBinding), "is attempting to grant RBAC permissions not currently held", "roleRef ... field is immutable", 401 Unauthorized versus 403 Forbidden, or a custom resource that view cannot read. Investigates with kubectl auth can-i, get and describe, and proposes fixes. Reads first and asks before changing anything.
- License
- Apache-2.0
Pinned to revision ce7de97330d7, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/k8s-rbac-troubleshooting/SKILL.md
- skills/k8s-rbac-troubleshooting/.claude-plugin/plugin.json
- skills/k8s-rbac-troubleshooting/references/authentication-and-admission.md
- skills/k8s-rbac-troubleshooting/references/bindings-and-roles.md
Every link opens the file at its source, pinned to the revision this page describes.