"Forbidden (superuser role required)" error when running certain RPK commands

Error:

{"message": "Forbidden (superuser role required)", "code": 403}

 

Resolution:

Run the rpk command on the controller node of your cluster.

First, you will want to locate the Controller ID of your Redpanda cluster. This can be identified by running the rpk cluster health command. In the output, you will see the Controller ID. This is going to be the node you will want to run the rpk command on.

 

More Details:

rpk commands directly interact with your Redpanda Clusters API's. When authentication is enabled on your cluster, certain API calls require the proper user/pass credentials in order to connect to those API's. Also, some of those APIs can only be run directly on the Controller Broker. rpk will be redirected to the Controller node in those cases, however the header information (Authentication) is not passed along with those redirects, which ends up causing the Forbidden error message. This is why the solution is to run the command directly on the Controller broker, so there is no redirect and your authorization credentials can be read correctly.

 

Similar to using the curl command, if you are redirected, curl will not include the headers unless you pass a specific flag telling it to include the headers on redirect. 

 

If you have any further questions, or need further guidance, please visit support.redpanda.com