Error from server (Forbidden): Cannot list resource ‘pods/namespaces’ at cluster scope – RBAC Permission Issue

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• When accessing the Supervisor Cluster using kubectl vsphere login, users are unable to list cluster resources such as namespaces, pods, and nodes. The following errors are observed:

[root@client-host~]# kubectl get ns 
Error from server (Forbidden) : namespaces is forbidden: User "sso:[e-mail]" cannot list resource "namespaces" in API group "" at the cluster scope

 [root@client-host ~]# kubectl get pods -A 
Error from server (Forbidden) : pods is forbidden: User "sso:[e-mail]" cannot list resource "pods" in API group "" at the cluster scope 

[root@client-host ~]# kubectl auth can-i list pods -n <namespace> 
no 

[root@client-host ~]# kubectl auth can-i list pods -A 
no

• However, when logging in using the administrator account ([e-mail]), the user is able to successfully list pods, namespaces, and nodes from the Supervisor Cluster context.
• Reviewing the ClusterRoleBindings (CRB) associated with the affected user, the following misconfiguration was identified (from kubectl_--request-timeout180-get-clusterrolebindings--o-yaml.txt):

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: view:<domain>:<user>
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: view
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: user@domain   # Missing 'sso:' prefix,using domain alias and not using FQDN

- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: configure-admission-policy:<domain>:<user>
  roleRef:
    kind: ClusterRole
    name: configure-admission-policy
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: user@domain

Environment

Supervisor 9.x

Cause

This issue occurs due to a mismatch between the Identity Provider (IDP) domain alias and the fully qualified domain name (FQDN) expected by the Supervisor Cluster.

In this scenario:

• The IDP is configured with a domain alias that differs from the actual FQDN
• The Supervisor Cluster currently recognizes only FQDN-based identities, not aliases
• As a result, the IDP is treated as unknown, and user identity mapping fails

Resolution

To resolve this issue, the configured Identity Provider (IDP) must be removed and reconfigured with the correct domain settings.

1. Log in to the vSphere Client using an account with SSO administrator privileges.
2. Navigate to:
   Administration → Single Sign-On → Configuration → Identity Provider
3. Review the existing Identity Provider configuration and verify whether the Domain Name (FQDN) and Domain Alias values are different.
4. If a mismatch is identified, delete the existing Identity Provider where the domain alias differs from the FQDN.
5. Create a new Identity Provider configuration.
6. During configuration, ensure that:
   • The Domain Alias is either:
     • Exactly the same as the Domain Name (FQDN), or
     • Left blank
7. Save the configuration.
8. Validate RBAC permissions on the Supervisor Cluster.

A permanent fix for this issue is currently in progress and will be included in a future vSphere release to properly handle domain alias and FQDN mappings in the Supervisor authorization service