Kubernetes / Cluster Operations, Access & Incident Response
Test the exact Kubernetes permission before granting a broad role
A user can read Pods but lack log, exec or namespace-specific access. Check the precise requested operation.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl auth can-i get pods --subresource=log -n appRead the result
This checks authorization for the current identity in the named namespace where the installed client supports the syntax. It does not validate application-level permissions.
Resolve and verify
Compare the required verb, resource and subresource with approved Role and RoleBinding intent. Request the smallest appropriate grant and verify the original operation.
Before changing production
Do not grant cluster-admin or use another operator's credentials to bypass a scoped access failure.