Unable to list nodes/pods resources in the vks cluster namespace "Error from server (Forbidden): nodes is forbidden: User "sso:[email protected]" cannot list resource "nodes" in API"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

User is unable to list cluster resources on the namespace level. We see the error complaining on permission issues while listing the nodes "kubectl get nodes"

Error from server (Forbidden): nodes is forbidden: User "sso:[email protected]" cannot list resource "nodes" in API

Environment

VMware vSphere KubernetesService 8.x

Cause

User should be assigned right permissions on the namespace level as per the docs

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vsphere-supervisor-services-and-standalone-components/latest/managing-vsphere-kubernetes-service/configuring-vsphere-namespaces-for-hosting-tkg-service-clusters/configure-vsphere-namespace-persmissions-for-vcenter-sso-users-and-groups.html

Resolution

• Once the user is created and assigned the owner/respective permission based on the requirement
• Login to the vks cluster using kubectl vsphere login from jumpbox and switch to the cluster context
• For eg, you see the contexts such as
  • cluster-abc #cluster namespace
  • abc1 #vsphere namespace
  • abc2 #vsphere namespace
• switch to the cluster context "kubectl config use-context cluster-abc" and list the nodes/pods "kubectl get pods"