Kubernetes / Cluster Operations, Access & Incident Response
Distinguish an authenticated Kubernetes Forbidden response from a login failure
A 403-style authorization failure is different from an expired credential or unreachable API. Preserve the exact server message.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl auth can-i list deployments -n appRead the result
The query tests one authorization decision for the current identity. It does not diagnose every authentication plugin or validate a different service account.
Resolve and verify
Match the failing request's identity, namespace, verb and resource with the intended bindings. Repair the narrow access policy through the owner and retest.
Before changing production
Do not rotate credentials or broaden roles before determining which identity the API actually authorized.