kubectl get pods fails for a clerk using a kubeconfig whose client…

Question

kubectl get pods fails for a clerk using a kubeconfig whose client certificate no longer matches any known user, while a coworker with a valid user but no RoleBinding sees Forbidden. How do these failures differ?

Accepted Answer

The clerk failed authentication; the coworker authenticated but lacked authorization — First the front desk has to recognize who you are; then security checks what you are allowed to touch. Bad kubeconfig identity never gets past recognition. A known user with no RoleBinding is recognized and then told no.

Answer

Both are authorization failures; authentication only applies to ServiceAccounts

Answer

Both are authentication failures; Forbidden always means the TLS handshake failed

Answer

The clerk hit a NetworkPolicy deny; the coworker hit an admission webhook deny

kubectl get pods fails for a clerk using a kubeconfig whose client certificate no longer matches any known user, while a coworker with a valid user but no RoleBinding sees Forbidden. How do these failures differ?

Short Explanation

Full Explanation