@@ -1508,14 +1508,17 @@ table contains the full details:
 | report cluster  | clusters: get<br/>pods: list<br/>pods/log: get<br/>jobs: list<br/>events: list<br/>PVCs: list                                                                                                                                                                                                                                                         |
 | report operator | **Required:**<br/>deployments: get<br/>**Optional (for full report):**<br/>configmaps: get<br/>events: list<br/>pods: list<br/>pods/log: get<br/>secrets: get<br/>services: get<br/>mutatingwebhookconfigurations: list[^1]<br/>validatingwebhookconfigurations: list[^1]<br/>**If OLM is present:**<br/>clusterserviceversions: list[^1]<br/>installplans: list[^1]<br/>subscriptions: list[^1] |
 | restart         | clusters: get,patch<br/>pods: get,delete                                                                                                                                                                                                                                                                                                              |
-| status          | clusters: get<br/>pods: list<br/>pods/exec: create<br/>pods/proxy: create<br/>PDBs: list<br/>objectstores.barmancloud.cnpg.io: get                                                                                                                                                                                                                    |
+| status          | clusters: get<br/>pods: list<br/>pods/exec: create (optional)<br/>pods/proxy: create<br/>PDBs: list<br/>objectstores.barmancloud.cnpg.io: get                                                                                                                                                                                                         |
 | subscription    | clusters: get<br/>pods: get,list<br/>pods/exec: create                                                                                                                                                                                                                                                                                                |
 | version         | none                                                                                                                                                                                                                                                                                                                                                  |
 
 [^1]: The permissions are cluster scope ClusterRole resources.
 
 ///Footnotes Go Here///
 
+Without `pods/exec`, `status` still works: the cluster size and, with
+`--verbose`, the PostgreSQL configuration are shown as not permitted.
+
 Additionally, assigning the `list` permission on the `clusters` will enable
 autocompletion for multiple commands.
 
 
@@ -22,6 +22,7 @@ package status
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -35,6 +36,7 @@ import (
 	"github.com/cloudnative-pg/machinery/pkg/stringset"
 	"github.com/cloudnative-pg/machinery/pkg/types"
 	"github.com/logrusorgru/aurora/v4"
+	authorizationv1 "k8s.io/api/authorization/v1"
 	corev1 "k8s.io/api/core/v1"
 	policyv1 "k8s.io/api/policy/v1"
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
@@ -218,11 +220,52 @@ func listFencedInstances(fencedInstances *stringset.Data) string {
 	return strings.Join(fencedInstances.ToList(), ", ")
 }
 
+// errExecNotPermitted is returned when the user lacks `pods/exec`
+var errExecNotPermitted = errors.New("not permitted: requires the pods/exec permission")
+
+// checkExecPermission returns errExecNotPermitted when the user cannot exec
+// into the primary Pod. If the check itself fails, it returns nil so the
+// command runs and reports the actual error. Without a primary Pod the review
+// would have no namespace and run at cluster scope, so it is skipped.
+func (fullStatus *PostgresqlStatus) checkExecPermission(
+	ctx context.Context,
+	client kubernetes.Interface,
+) error {
+	if fullStatus.PrimaryPod.Name == "" {
+		return nil
+	}
+
+	pod := &fullStatus.PrimaryPod
+	review, err := client.AuthorizationV1().SelfSubjectAccessReviews().Create(
+		ctx,
+		&authorizationv1.SelfSubjectAccessReview{
+			Spec: authorizationv1.SelfSubjectAccessReviewSpec{
+				ResourceAttributes: &authorizationv1.ResourceAttributes{
+					Namespace:   pod.Namespace,
+					Verb:        "create",
+					Resource:    "pods",
+					Subresource: "exec",
+					Name:        pod.Name,
+				},
+			},
+		},
+		metav1.CreateOptions{},
+	)
+	if err == nil && !review.Status.Allowed {
+		return errExecNotPermitted
+	}
+	return nil
+}
+
 func (fullStatus *PostgresqlStatus) getClusterSize(
 	ctx context.Context,
 	client kubernetes.Interface,
 	timeout time.Duration,
 ) (string, error) {
+	if err := fullStatus.checkExecPermission(ctx, client); err != nil {
+		return "", err
+	}
+
 	// Compute the disk space through `du`
 	output, _, err := utils.ExecCommand(
 		ctx,
@@ -322,6 +365,8 @@ func (fullStatus *PostgresqlStatus) printBasicInfo(
 			summary.AddLine("Size:", "- (hibernated)")
 		case isPrimaryFenced:
 			summary.AddLine("Size:", "- (fenced)")
+		case errors.Is(clusterSizeErr, errExecNotPermitted):
+			summary.AddLine("Size:", "- ("+clusterSizeErr.Error()+")")
 		default:
 			summary.AddLine("Size:", aurora.Red(clusterSizeErr.Error()))
 		}
@@ -491,6 +536,17 @@ func (fullStatus *PostgresqlStatus) printPostgresConfiguration(
 	client kubernetes.Interface,
 	timeout time.Duration,
 ) []error {
+	if err := fullStatus.checkExecPermission(ctx, client); err != nil {
+		notPermitted := "- (" + err.Error() + ")"
+		fmt.Println(aurora.Green("PostgreSQL Configuration"))
+		fmt.Println(notPermitted)
+		fmt.Println()
+		fmt.Println(aurora.Green("PostgreSQL HBA Rules"))
+		fmt.Println(notPermitted)
+		fmt.Println()
+		return nil
+	}
+
 	var errs []error
 
 	// Read PostgreSQL configuration from custom.conf
 
@@ -20,12 +20,19 @@ SPDX-License-Identifier: Apache-2.0
 package status
 
 import (
+	"context"
 	"fmt"
 	"time"
 
+	authorizationv1 "k8s.io/api/authorization/v1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes/fake"
+	k8stesting "k8s.io/client-go/testing"
 
 	apiv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
+	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -229,3 +236,61 @@ var _ = Describe("groupInstancesByFailureDomain", func() {
 		Expect(groups[0].display).To(ContainSubstring("topology.kubernetes.io/region=us-east-1"))
 	})
 })
+
+var _ = Describe("status without the pods/exec permission", func() {
+	var client *fake.Clientset
+
+	BeforeEach(func() {
+		client = fake.NewSimpleClientset()
+		client.PrependReactor("create", "selfsubjectaccessreviews",
+			func(action k8stesting.Action) (bool, runtime.Object, error) {
+				review, ok := action.(k8stesting.CreateAction).GetObject().(*authorizationv1.SelfSubjectAccessReview)
+				Expect(ok).To(BeTrue())
+				review.Status.Allowed = false
+				return true, review, nil
+			})
+	})
+
+	It("reports it without running du", func() {
+		fullStatus := &PostgresqlStatus{
+			PrimaryPod: corev1.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "cluster-example-1"}},
+		}
+
+		size, err := fullStatus.getClusterSize(context.Background(), client, time.Second)
+
+		Expect(err).To(MatchError(errExecNotPermitted))
+		Expect(size).To(BeEmpty())
+
+		actions := client.Actions()
+		Expect(actions).To(HaveLen(1))
+		review, ok := actions[0].(k8stesting.CreateAction).GetObject().(*authorizationv1.SelfSubjectAccessReview)
+		Expect(ok).To(BeTrue())
+		Expect(review.Spec.ResourceAttributes).To(Equal(&authorizationv1.ResourceAttributes{
+			Namespace:   "default",
+			Verb:        "create",
+			Resource:    "pods",
+			Subresource: "exec",
+			Name:        "cluster-example-1",
+		}))
+	})
+
+	It("skips the configuration reads", func() {
+		fullStatus := &PostgresqlStatus{
+			PrimaryPod: corev1.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "cluster-example-1"}},
+		}
+
+		errs := fullStatus.printPostgresConfiguration(context.Background(), client, time.Second)
+
+		Expect(errs).To(BeEmpty())
+		Expect(client.Actions()).To(HaveLen(1))
+	})
+
+	It("does not blame the permission when there is no primary Pod", func() {
+		fullStatus := &PostgresqlStatus{}
+
+		_, err := fullStatus.getClusterSize(context.Background(), client, time.Second)
+
+		Expect(err).To(MatchError(utils.ErrorContainerNotFound))
+		Expect(client.Actions()).To(BeEmpty())
+	})
+})