What causes "user is not authorized to get pods" in derailed/k9s?

Grant get on pods in that namespace (resources ["pods"], verbs ["get"])

user is not authorized to get pods

Error message

user is not authorized to get pods

What it means

PortForwarder.Start authorizes get on the target pod in its namespace before building any tunnel — port-forwarding must read the pod to locate it. This is the first of two RBAC gates (the second is create on pods/portforward).

Source

Thrown at internal/dao/port_forwarder.go:130

	return p.path + ":" + p.tunnel.Container
}

// HasPortMapping checks if port mapping is defined for this fwd.
func (p *PortForwarder) HasPortMapping(portMap string) bool {
	return p.tunnel.PortMap() == portMap
}

// Start initiates a port forward session for a given pod and ports.
func (p *PortForwarder) Start(path string, tt port.PortTunnel) (*portforward.PortForwarder, error) {
	p.path, p.tunnel, p.age = path, tt, time.Now()

	ns, n := client.Namespaced(path)
	auth, err := p.Client().CanI(ns, client.PodGVR, n, client.GetAccess)
	if err != nil {
		return nil, err
	}
	if !auth {
		return nil, fmt.Errorf("user is not authorized to get pods")
	}

	podName := strings.Split(n, "|")[0]
	var res Pod
	res.Init(p, client.PodGVR)
	pod, err := res.GetInstance(client.FQN(ns, podName))
	if err != nil {
		return nil, err
	}
	if pod.Status.Phase != v1.PodRunning {
		return nil, fmt.Errorf("unable to forward port because pod is not running. Current status=%v", pod.Status.Phase)
	}

	auth, err = p.Client().CanI(ns, client.PodGVR.WithSubResource("portforward"), "", []string{client.CreateVerb})
	if err != nil {
		return nil, err
	}
	if !auth {

View on GitHub (pinned to 2d3ccc6ba2)

Solutions

Grant get on pods in that namespace (resources ["pods"], verbs ["get"])
Verify: kubectl auth can-i get pods -n <ns>
Ensure both halves of the RBAC pair are present: get pods AND create pods/portforward

Defensive patterns

Strategy: validation

Validate before calling

ns, n := client.Namespaced(path)
ok, err := client.CanI(ns, client.PodGVR, strings.Split(n, "|")[0], client.GetAccess)
if err != nil { return err }
if !ok { return fmt.Errorf("cannot read pod in %s; get on pods required", ns) }

Try / catch

if _, err := pf.Start(path, tunnel); err != nil {
    if strings.Contains(err.Error(), "not authorized to get pods") {
        // fix RBAC (get pods) before retrying; tunnel was never attempted
    }
}

Prevention

Grant the RBAC pair together: get pods + create pods/portforward
Validate the pod path (namespace|pod|container) before starting a forward
Feature-detect authorization once and disable port-forward actions when denied

When it happens

Trigger: CanI(ns, pods, <pod>, get) false at the moment Start is called — the user/service account cannot even read the pod being forwarded to.

Common situations: Roles granting create on pods/portforward but not get on pods; forwarding into namespaces the user was granted tunnel rights in but not read rights; typos in the pod path picking a namespace the user cannot see.

Related errors

AI-assisted analysis of derailed/k9s@2d3ccc6ba2 (2026-08-15). Data as JSON: /api/errors/c459484ec92d6b90. Report an issue: GitHub.