<h2>env</h2>
<ul>
<li>GKE Autopilot v1.22.12-gke.2300</li>
<li>use kubectl command from ubuntu2004 VM</li>
<li>use <a href="https://cloud.google.com/kubernetes-engine/docs/deprecations/auth-plugin?hl=en" rel="nofollow noreferrer">gke-gcloud-auth-plugin</a></li>
</ul>
<h2>what happens</h2>
<p>kubectl command sometimes return (Forbidden) error. e.g.)</p>
<pre><code>kubectl get pod
</code></pre>
<blockquote>
<p>Error from server (Forbidden): pods is forbidden: User &quot;my-mail@domain.com&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;default&quot;: GKEAutopilot authz: the request was sent before policy enforcement is enabled</p>
</blockquote>
<p>It happens <strong>not always</strong>, so it must not be IAM problem. (it happens about 40%).<br />
Before, I thinks it was GKE Autopilot v1.21.xxxx, this error didn't happen; at least not such frequently.</p>
<p>I couldn't find any helpful info even if I searched &quot;GKEAutopilot authz&quot;, or &quot;the request was sent before policy enforcement is enabled&quot;</p>
<p>I wish if someone who faced to same issue has any idea.</p>
<p>Thank you in advance</p>

Ryo
<p>I asked google cloud support.
They said it's bug on GKE master, and was fixed by them.</p>
<p>This problem doesn't happen anymore</p>
