Error: node is forbidden: User "sso:[email protected]" cannot list resource "nodes" in API group "" at the cluster scope while running kubectl commands on a Guest Cluster using VCF-CLI

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• Successfully able to login to a Guest Cluster using a domain user via VCF-CLI.
• The role assigned to the domain user or a group is "Namespace Owner"
• The same role if assigned to a vsphere.local (local SSO) user, this issue is not seen.
• When logged in with a Domain user and try to execute any kubectl command, below error is seen:
  
  Error from server (Forbidden): nodes is forbidden: User "sso:[email protected]" cannot list resource "nodes" in API group "" at the cluster scope


• Identity Source is configured from the vCenter level and not from the VCFOps.

Environment

• VMware Cloud Foundation 9.x
• vSphere Kubernetes Service

Cause

• This issue occurs due to an Identity Source alias mismatch between the Active Directory configuration on the vCenter level and the Kubernetes RBAC requirements.
• When an Identity Source is configured manually on a standalone vCenter, the "Domain Alias" often defaults to the short NetBIOS name (e.g., domain_name) instead of the FQDN (e.g., domain_name.local).
• The sync controller then maps the user with the short alias, causing a mismatch with the FQDN required by the Kubernetes Guest Cluster RBAC policies.
• While checking the clusterrolebindings for a user or a group which is having this issue, it is seen that the name under rbac.authorization is not configured as required. 
  
  
  • k get clusterrolebinding "vmware-system-auth-sync-edit:<domain_name>:<user_or_group_name>" -o yaml

- apiGroup: rbac.authorization.k8s.io
kind: Group
name: <group_name>@domain_alias_name
    
    
  • The correct entry should look like:
    
    - apiGroup: rbac.authorization.k8s.io
kind: Group
name: sso:<group_name>@domain_name

Resolution

To resolve this issue, use the VCFOps for all SSO authentication configurations.

1. Remove the manually created Identity Source from the vCenter UI.
2. Configure the SSO authentication directly from the VCF SDDC Manager (VCFOps) level.
3. Verify that the automation correctly populates the vCenter SSO Identity Source using the FQDN (e.g., example.com) for both the domain and the alias.

By configuring AD via VCFOps, the system ensures the correct sso:@example.com string is pushed to the Kubernetes Guest Clusters, satisfying the Kubernetes RBAC requirements.

Additional Information

VMware Identity Broker - vCenter Server