Hands-on Lab·Certified Kubernetes Administrator
Troubleshooting Authentication and Authorization Failures
Four ways a request fails to reach an object, produced deliberately one after another, so the error text tells you which layer to look at instead of sending you to RBAC every time.
Troubleshooting Guide 103 of 103 Intermediate
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 17 min
The ServiceAccount token here is created with a 30 minute lifetime. Nothing on this page changes cluster configuration.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a request never reaches the object and you cannot tell whether it was rejected for who you are or for what you asked for. This matters because authentication and authorization fail differently - and one of these four failures produces no error message at all.
- finding out who you currently are with
kubectl auth whoami - building a second identity from a ServiceAccount token and making a request as it
- changing one character of that token and seeing what an authentication failure looks like
- trusting the wrong CA, and getting a failure that is neither authentication nor authorization
- meeting the worst case of all - the failure that produces no error message whatsoever
Before you start
- guide 15 - what a 403 means, before this covers the failures that are not one.
-
Who you are right now
-
Build a second identity and use it
-
The same request with a broken token
-
The same request with the wrong CA
-
The failure with no error message