kubectl "cannot get/create namespaces" - Fix Cluster-Scope RBAC
A namespaced RoleBinding cannot grant access to cluster-scoped resources. If CI needs to manage namespaces, nodes, CRDs, or ClusterRoles, it requires a ClusterRole bound with a ClusterRoleBinding.
What this error means
kubectl reports <resource> is forbidden: User "<id>" cannot <verb> resource "<res>" at the cluster scope. The identity may have namespaced access but is denied on cluster-scoped objects.
kubectl output
Error from server (Forbidden): namespaces is forbidden: User
"system:serviceaccount:ci:deployer" cannot create resource "namespaces" in API
group "" at the cluster scopeDiagnose it: read events and previous logs
Terminal
kubectl --context "$KUBE_CONTEXT" -n "$NS" get pods -o wide
kubectl -n "$NS" describe pod <pod> | sed -n "/Events/,$p"
kubectl -n "$NS" logs <pod> --previous --tail=50Common causes
Only a namespaced Role is bound
A Role/RoleBinding grants access within one namespace; it cannot authorize cluster-scoped resources, which live outside any namespace.
Trying to manage cluster resources from CI
Creating namespaces, installing CRDs, or binding cluster roles all require cluster-scoped grants the pipeline SA does not have.
How to fix it
Grant a ClusterRole with a ClusterRoleBinding
Scope the ClusterRole to the specific cluster-scoped verbs/resources the pipeline needs.
Terminal
kubectl create clusterrole ns-manager \
--verb=get,list,create --resource=namespaces
kubectl create clusterrolebinding ci-ns-manager \
--clusterrole=ns-manager --serviceaccount=ci:deployerVerify the cluster-scoped permission
Terminal
kubectl auth can-i create namespaces \
--as=system:serviceaccount:ci:deployerHow to prevent it
- Use ClusterRole/ClusterRoleBinding for cluster-scoped resources, Role/RoleBinding for namespaced ones.
- Keep cluster-scoped grants minimal and reviewed in git.
- Pre-flight with
kubectl auth can-i ...at the cluster scope.
Frequently asked questions
What causes kubectl "cannot get/create namespaces"?
There are 2 common causes: only a namespaced role is bound and trying to manage cluster resources from ci. A Role/RoleBinding grants access within one namespace; it cannot authorize cluster-scoped resources, which live outside any namespace.
How do I fix kubectl "cannot get/create namespaces"?
There are 2 fixes depending on which cause you have: grant a clusterrole with a clusterrolebinding and verify the cluster-scoped permission. Work through them in order, since the first is the most common.
What does kubectl "cannot get/create namespaces" actually mean?
kubectl reports <resource> is forbidden: User "<id>" cannot <verb> resource "<res>" at the cluster scope.
How do I stop kubectl "cannot get/create namespaces" happening again?
Use ClusterRole/ClusterRoleBinding for cluster-scoped resources, Role/RoleBinding for namespaced ones. The prevention section lists 3 changes that keep it from recurring.