kubectl "cannot get/create namespaces" - Fix Cluster-Scope RBAC

A namespaced RoleBinding cannot grant access to cluster-scoped resources. If CI needs to manage namespaces, nodes, CRDs, or ClusterRoles, it requires a ClusterRole bound with a ClusterRoleBinding.

What this error means

kubectl reports <resource> is forbidden: User "<id>" cannot <verb> resource "<res>" at the cluster scope. The identity may have namespaced access but is denied on cluster-scoped objects.

kubectl output

Error from server (Forbidden): namespaces is forbidden: User
"system:serviceaccount:ci:deployer" cannot create resource "namespaces" in API
group "" at the cluster scope

Common causes

Only a namespaced Role is bound

A Role/RoleBinding grants access within one namespace; it cannot authorize cluster-scoped resources, which live outside any namespace.

Trying to manage cluster resources from CI

Creating namespaces, installing CRDs, or binding cluster roles all require cluster-scoped grants the pipeline SA does not have.

How to fix it

Grant a ClusterRole with a ClusterRoleBinding

Scope the ClusterRole to the specific cluster-scoped verbs/resources the pipeline needs.

Terminal

kubectl create clusterrole ns-manager \
  --verb=get,list,create --resource=namespaces
kubectl create clusterrolebinding ci-ns-manager \
  --clusterrole=ns-manager --serviceaccount=ci:deployer

Verify the cluster-scoped permission