rbac

An authorization error from kubectl exec often looks illogical: cannot create resource "pods/exec" The Pod already exists. The command does not create another Pod or modify its specification. get or update might therefore seem like the expected permission, but Kubernetes checks for create. The reason is that RBAC describes Kubernetes API operations, not the literal meaning of kubectl commands. exec is a separate subresource kubectl exec does not operate directly on the pods resource. It calls the pods/exec subresource: ...