diff --git a/pkg/genericapiserver/api/handlers/responsewriters/errors.go b/pkg/genericapiserver/api/handlers/responsewriters/errors.go
index ddf31e4e168..2a5d51b0a91 100644
--- a/pkg/genericapiserver/api/handlers/responsewriters/errors.go
+++ b/pkg/genericapiserver/api/handlers/responsewriters/errors.go
@@ -56,6 +56,9 @@ func forbiddenMessage(attributes authorizer.Attributes) string {
 	if group := attributes.GetAPIGroup(); len(group) > 0 {
 		resource = resource + "." + group
 	}
+	if subresource := attributes.GetSubresource(); len(subresource) > 0 {
+		resource = resource + "/" + subresource
+	}
 
 	if ns := attributes.GetNamespace(); len(ns) > 0 {
 		return fmt.Sprintf("User %q cannot %s %s in the namespace %q.", username, attributes.GetVerb(), resource, ns)