{"record":{"id":"c459484ec92d6b90","repo":"derailed/k9s","slug":"user-is-not-authorized-to-get-pods","errorCode":null,"errorMessage":"user is not authorized to get pods","messagePattern":"user is not authorized to get pods","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/dao/port_forwarder.go","lineNumber":130,"sourceCode":"\treturn p.path + \":\" + p.tunnel.Container\n}\n\n// HasPortMapping checks if port mapping is defined for this fwd.\nfunc (p *PortForwarder) HasPortMapping(portMap string) bool {\n\treturn p.tunnel.PortMap() == portMap\n}\n\n// Start initiates a port forward session for a given pod and ports.\nfunc (p *PortForwarder) Start(path string, tt port.PortTunnel) (*portforward.PortForwarder, error) {\n\tp.path, p.tunnel, p.age = path, tt, time.Now()\n\n\tns, n := client.Namespaced(path)\n\tauth, err := p.Client().CanI(ns, client.PodGVR, n, client.GetAccess)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !auth {\n\t\treturn nil, fmt.Errorf(\"user is not authorized to get pods\")\n\t}\n\n\tpodName := strings.Split(n, \"|\")[0]\n\tvar res Pod\n\tres.Init(p, client.PodGVR)\n\tpod, err := res.GetInstance(client.FQN(ns, podName))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif pod.Status.Phase != v1.PodRunning {\n\t\treturn nil, fmt.Errorf(\"unable to forward port because pod is not running. Current status=%v\", pod.Status.Phase)\n\t}\n\n\tauth, err = p.Client().CanI(ns, client.PodGVR.WithSubResource(\"portforward\"), \"\", []string{client.CreateVerb})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !auth {","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/derailed/k9s/blob/2d3ccc6ba2ce98c3781bfc441bb3e884f072774f/internal/dao/port_forwarder.go#L112-L148","documentation":"PortForwarder.Start authorizes get on the target pod in its namespace before building any tunnel — port-forwarding must read the pod to locate it. This is the first of two RBAC gates (the second is create on pods/portforward).","triggerScenarios":"CanI(ns, pods, <pod>, get) false at the moment Start is called — the user/service account cannot even read the pod being forwarded to.","commonSituations":"Roles granting create on pods/portforward but not get on pods; forwarding into namespaces the user was granted tunnel rights in but not read rights; typos in the pod path picking a namespace the user cannot see.","solutions":["Grant get on pods in that namespace (resources [\"pods\"], verbs [\"get\"])","Verify: kubectl auth can-i get pods -n <ns>","Ensure both halves of the RBAC pair are present: get pods AND create pods/portforward"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"ns, n := client.Namespaced(path)\nok, err := client.CanI(ns, client.PodGVR, strings.Split(n, \"|\")[0], client.GetAccess)\nif err != nil { return err }\nif !ok { return fmt.Errorf(\"cannot read pod in %s; get on pods required\", ns) }","typeGuard":null,"tryCatchPattern":"if _, err := pf.Start(path, tunnel); err != nil {\n    if strings.Contains(err.Error(), \"not authorized to get pods\") {\n        // fix RBAC (get pods) before retrying; tunnel was never attempted\n    }\n}","preventionTips":["Grant the RBAC pair together: get pods + create pods/portforward","Validate the pod path (namespace|pod|container) before starting a forward","Feature-detect authorization once and disable port-forward actions when denied"],"tags":["kubernetes","rbac","port-forward","pod"],"backgroundTag":null,"analyzedSha":"2d3ccc6ba2ce98c3781bfc441bb3e884f072774f","analyzedAt":"2026-08-15T16:09:14.432Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}