Fix: Error from server (Forbidden): … is forbidden: User … cannot … in OpenShift

The API server rejected the request because the identity making it has no role that allows this action. Typical messages look like this:

Error from server (Forbidden): nodes is forbidden: User "developer" cannot list resource "nodes" in API group "" at the cluster scope

Error from server (Forbidden): namespaces "shop-dev" is forbidden: User "developer" cannot patch resource "namespaces" in API group "" in the namespace "shop-dev"

Error from server (Forbidden): templates.template.openshift.io is forbidden: User "system:serviceaccount:default:examplesa" cannot list resource "templates" in API group "template.openshift.io" in the namespace "example"

Read the message

• User: who made the request. system:serviceaccount:PROJECT:NAME means a pod or pipeline using a service account, not you.
• Verb: get, list, watch, create, update, patch or delete.
• Resource and API group: "" is the core group (pods, secrets, namespaces); OpenShift types use groups such as route.openshift.io or template.openshift.io.
• Scope: in the namespace “X” means a project-level permission is missing; at the cluster scope means the resource is cluster-wide (nodes, namespaces, storage classes, cluster Operators) and needs a cluster role.

Causes, most likely first

1. Wrong project or cluster. You meant to work in a project where you have access but your current context points somewhere else.
2. Missing role in the project. You have view but the action needs edit or admin; for example, view cannot read Secrets, and edit cannot change role bindings.
3. Cluster-scoped resource. Normal users cannot list nodes, change namespaces or read cluster Operators. Ask an administrator instead of asking for cluster-admin.
4. A service account lacks a role. A pod, CI job or Operator calls the API with its own service account, which by default can do very little.
5. Logged in as the wrong user, for example an old token saved in your kubeconfig.

Diagnose

oc whoami
oc project
oc auth can-i list pods -n shop-dev
oc auth can-i patch namespaces
oc auth can-i list templates.template.openshift.io -n example \
  --as=system:serviceaccount:default:examplesa

oc auth can-i answers yes or no for the exact verb, resource and namespace from the error. Users allowed to impersonate (usually administrators) can check other identities with --as. To see who already has a permission in a project:

oc adm policy who-can list pods -n shop-dev
oc get rolebindings -n shop-dev
oc describe rolebinding.rbac -n shop-dev

Fix

1. If you were in the wrong place, switch with oc project NAME or add -n NAME, then retry.
2. If you need more rights in a project, a project admin grants the smallest default role that covers the action:

oc adm policy add-role-to-user view alice -n shop-dev
oc adm policy add-role-to-user edit alice -n shop-dev
oc adm policy add-role-to-group edit dev-team -n shop-dev

1. For a service account, bind the role to it with -z. If no default role fits, create a narrow role with only the verbs and resources needed:

oc policy add-role-to-user view -z examplesa -n example

oc create role template-reader --verb=get,list --resource=templates.template.openshift.io -n example
oc create rolebinding examplesa-templates --role=template-reader \
  --serviceaccount=default:examplesa -n example

1. For cluster-scoped resources, a cluster administrator binds a cluster role, for example cluster-reader for read-only access across the cluster: oc adm policy add-cluster-role-to-user cluster-reader alice.

Avoid fixing this by granting cluster-admin or admin to service accounts. Also note that even project admins cannot grant access to Security Context Constraints; that needs a cluster administrator. Run oc auth can-i again to confirm before retrying the original command.

Official documentation

• Using RBAC to define and apply permissions
• Kubernetes: Authorization and checking API access