<p>I've googled few days and haven't found any decisions.
I've tried to update k8s  from 1.19.0 to 1.19.6 In Ubuntu-20.
(cluster manually installed k81 - master and k82 - worker node)</p>
<pre><code># kubeadm upgrade plan
[upgrade/config] Making sure the configuration is correct:
[upgrade/config] Reading configuration from the cluster...
[upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
[preflight] Running pre-flight checks.
[preflight] Some fatal errors occurred:
    [ERROR CoreDNSUnsupportedPlugins]: couldn't retrieve DNS addon deployments: deployments.apps is forbidden: User &quot;system:node:k81&quot; cannot list resource &quot;deployments&quot; in API group &quot;apps&quot; in the namespace &quot;kube-system&quot;
    [ERROR CoreDNSMigration]: couldn't retrieve DNS addon deployments: deployments.apps is forbidden: User &quot;system:node:k81&quot; cannot list resource &quot;deployments&quot; in API group &quot;apps&quot; in the namespace &quot;kube-system&quot;
    [ERROR kubeDNSTranslation]: configmaps &quot;kube-dns&quot; is forbidden: User &quot;system:node:k81&quot; cannot get resource &quot;configmaps&quot; in API group &quot;&quot; in the namespace &quot;kube-system&quot;: no relationship found between node 'k81' and this object
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
To see the stack trace of this error execute with --v=5 or higher

</code></pre>
<p>When I try to list roles and permissions under kubernetes-admin user - it shows the same error with permissions:</p>
<pre><code>~# kubectl get rolebindings,clusterrolebindings --all-namespaces
Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User &quot;system:node:k81&quot; cannot list resource &quot;rolebindings&quot; in API group &quot;rbac.authorization.k8s.io&quot; at the cluster scope
Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User &quot;system:node:k81&quot; cannot list resource &quot;clusterrolebindings&quot; in API group &quot;rbac.authorization.k8s.io&quot; at the cluster scope
</code></pre>
<p>I can list pods and cluster nodes:</p>
<pre><code># kubectl get nodes 
NAME   STATUS   ROLES    AGE    VERSION
k81    Ready    master   371d   v1.19.6
k82    Ready    &lt;none&gt;   371d   v1.19.6

# kubectl get pods --all-namespaces 
NAMESPACE                   NAME                                            READY   STATUS      RESTARTS   AGE
gitlab-managed-apps         gitlab-runner-gitlab-runner-6bf497d6c9-g7rhc    1/1     Running     47         27d
gitlab-managed-apps         prometheus-kube-state-metrics-c6bbb8465-8kls5   1/1     Running     3          27d
ingress-nginx               ingress-nginx-controller-848bfcb64d-r6k6k       1/1     Running     3          27d
kube-system                 coredns-f9fd979d6-6dd42                         1/1     Running     1          24h
kube-system                 coredns-f9fd979d6-zjsnz                         1/1     Running     1          24h
kube-system                 csi-nfs-controller-5bd5cb55bc-76xdm             3/3     Running     69         27d
kube-system                 csi-nfs-controller-5bd5cb55bc-mkwmv             3/3     Running     61         27d
kube-system                 csi-nfs-node-b4v4g                              3/3     Running     18         49d
kube-system                 etcd-k81                                        1/1     Running     30         371d
kube-system                 kube-apiserver-k81                              1/1     Running     54         371d
kube-system                 kube-controller-manager-k81                     1/1     Running     27         5d22h
kube-system                 kube-flannel-ds-l4xkx                           1/1     Running     13         371d
kube-system                 kube-flannel-ds-rdm4n                           1/1     Running     5          371d
kube-system                 kube-proxy-4976l                                1/1     Running     5          371d
kube-system                 kube-proxy-g2fn4                                1/1     Running     11         371d
kube-system                 kube-scheduler-k81                              1/1     Running     330        371d
kube-system                 tiller-deploy-f5c865db5-zlgk9                   1/1     Running     5          27d

# kubectl  logs coredns-f9fd979d6-zjsnz  -n kube-system
Error from server (Forbidden): pods &quot;coredns-f9fd979d6-zjsnz&quot; is forbidden: User &quot;system:node:k81&quot; cannot get resource &quot;pods/log&quot; in API group &quot;&quot; in the namespace &quot;kube-system&quot;
</code></pre>
<pre><code># kubectl config get-contexts
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin


# kubectl get csr
No resources found
</code></pre>

<p>The solution for the issue is to <a href="https://v1-19.docs.kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-kubeconfig" rel="nofollow noreferrer">regenerate the kubeconfig file for the admin</a>:</p>
<pre class="lang-sh prettyprint-override"><code>sudo kubeadm init phase kubeconfig admin --kubeconfig-dir=.
</code></pre>
<p>Above command will create the <code>admin.conf</code> file in the current directory (let's say it is <code>/home/user/testing/</code>) so when you are running <code>kubectl</code> commands you need to specify it using <code>--kubeconfig {directory}/admin.conf</code> flag, for example:</p>
<pre class="lang-sh prettyprint-override"><code>sudo kubectl get rolebindings,clusterrolebindings --all-namespaces --kubeconfig /home/user/testing/admin.conf
</code></pre>
<p>As you are using <code>/etc/kubernetes/admin.conf</code> file by default, you can delete it and create a new one in <code>/etc/kubernetes</code> directory:</p>
<pre><code>sudo rm /etc/kubernetes/admin.conf
sudo kubeadm init phase kubeconfig admin --kubeconfig-dir=/etc/kubernetes/
</code></pre>
