Provisioning Guest Cluster Fails with 403 Forbidden Error due to Missing ClusterRoleBinding

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• When provisioning a new guest cluster using automated scripts or kubectl commands, the operation fails with "Forbidden" (403) errors.

• During the provisioning process, the following error messages appear:

  Error from server (Forbidden): error when retrieving current configuration...
calicoconfigs.cni.tanzu.vmware.com "tkgs-n-#####" is forbidden: User "sso:#####" cannot get resource "calicoconfigs"
clusterbootstraps.run.tanzu.vmware.com "tkgs-n-#####" is forbidden: User "sso:#####" cannot get resource "clusterbootstraps"
clusters.cluster.x-k8s.io "tkgs-n-#####" is forbidden: User "sso:#####" cannot get resource "clusters"

Environment

vSphere Kubernetes Service (VKS)

Cause

The user account or service account lacks the necessary Kubernetes RBAC permissions to access required resources in the guest cluster namespace. This is typically due to a missing ClusterRoleBinding that prevents the system from retrieving configurations for resources such as calicoconfigs, clusterbootstraps, and clusters.

Resolution

1. Ensure that the user account is correctly assigned as the owner of the namespace in the vSphere Client.
2. Log in to the Supervisor Cluster and run a basic resource check:
   kubectl vsphere login --server <Supervisor_IP> --vsphere-username <username>@<domain>
3. Manually create a ClusterRoleBinding to map the SSO user or group to a native ClusterRole. Replace the brackets with the specific environment values:
   kubectl create clusterrolebinding <binding-name> --clusterrole=<role-name> --user=sso:<username>@<domain>
(Example: kubectl create clusterrolebinding my-binding --clusterrole=cluster-admin --user=sso:[email protected])
4. Verify access by logging in as the affected user and running:
   kubectl auth can-i list pods --all-namespaces

Additional Information

For further assistance, contact Broadcom Support