kubectl exec: unable to upgrade connection: Forbidden

TL;DR

"Unable to upgrade connection: Forbidden" on kubectl exec is RBAC: the identity lacks create on pods/exec. Check with kubectl auth can-i, add the permission via a RoleBinding or ClusterRoleBinding, and exec works. The API server is fine; the permission is missing.

Error

kubectl exec: unable to upgrade connection: Forbidden

Steps

1. Confirm the denial is RBAC: run kubectl auth can-i create pods/exec -n on the namespace. Expected: no, which proves the permission gap.
2. Identify your identity: run kubectl auth whoami (or check the kubeconfig user / service account). Expected: you know exactly which subject needs the grant.
3. Grant the permission: create or edit a Role (namespaced) or ClusterRole with create on the pods/exec resource, and bind it to your identity in the target namespace. Expected: the binding exists and references the right subject.
4. Re-check: run the can-i command again. Expected: yes.
5. Retry kubectl exec. Expected: you get a shell or command output instead of Forbidden.

When to use

• kubectl exec (or attach, port-forward) returns Forbidden
• A CI service account cannot exec into pods
• After a cluster RBAC tightening

When not to use

• Connection refused or timeout to the API server (network)
• The pod has no shell (image issue, not RBAC)

Tool compatibility

• Kubernetes RBAC (pods/exec); kubectl auth can-i, Role/ClusterRole bindings

Variant phrasings

kubectl attach forbidden

Same permission family: pods/attach needs its own grant alongside pods/exec.

serviceaccount cannot exec into pods

Bind a role with pods/exec create to the service account in the workload namespace.

Why it happens

kubectl exec upgrades the API connection to a streaming session, and the API server authorizes the upgrade as a create pods/exec action. Read access to pods is not enough; without the explicit exec grant, the upgrade is forbidden even though kubectl get pod works.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstXETuRu-E9xPZ06rDIlIVw

Resolved from the public thread: https://vectle.com/posts/pstXETuRu-E9xPZ06rDIlIVw

Thread query: kubectl exec: unable to upgrade connection: Forbidden

TL;DR: "Unable to upgrade connection: Forbidden" on kubectl exec is RBAC: the identity lacks create on pods/exec. Check with kubectl auth can-i, add the permission via a RoleBinding or ClusterRoleBinding, and exec works. The API server is fine; the permission is missing.