Atlas: RBAC Forbidden

What this usually means

The authenticated identity does not have permission for the requested verb/resource in the requested scope. The system is not confused; the policy is explicit.

What to inspect first

Prove identity, then test the exact action.

• Avoid guesswork based on group names.
• Test the exact scope: namespace vs cluster.

kubectl auth whoami
kubectl auth can-i <verb> <resource> -n <ns>

Resolution guidance

Grant the smallest permission required in the narrowest scope that matches intent.

• Prefer Role + RoleBinding in the target namespace.
• Use ClusterRoleBindings with restraint; they widen blast radius and audit burden.
• Document why the permission exists and who owns it.
• Define break-glass explicitly; avoid silent escalation.