<p>When I run a simple command on my local shell with gcloud sdk.</p>

<pre><code>$ kubectl get pod
</code></pre>

<p>I get such error:</p>

<blockquote>
  <p>Error from server (Forbidden): pods is forbidden: User "client" cannot list pods at the cluster scope: Unknown user "client"</p>
</blockquote>

<p>The same command runs fine on GCP cloud shell, and the output of</p>

<pre><code>$ gcloud auth list
</code></pre>

<p>is as expected:</p>

<blockquote>
  <p>Credentialed Accounts<br>
       <code>ACTIVE  ACCOUNT</code><br>
       <code>*       foo@bar.com</code></p>
</blockquote>

<p>I also tried to create clusterrolebinding, but get similar error.</p>

<p>This happens when you disable Legacy Authorisation in the cluster settings, because the client certificate that you are using is a legacy authentication method. So it looks like what is happening is the client authentication succeeds but the authorisation fails, as expected. ("Unknown user" in the error message, confusingly, seems to mean the user is unknown to the authorisation system, not to the authentication system.)</p>

<p>You can either disable the use of the client certificate with</p>

<pre><code>gcloud config unset container/use_client_certificate
</code></pre>

<p>and then regenerate your kubectl config with</p>

<pre><code>gcloud container clusters get-credentials my-cluster
</code></pre>

<p>Or you can simply re-enable Legacy Authorisation in the cluster settings in the Google Cloud Console, or using the command:</p>

<pre><code>gcloud container clusters update [CLUSTER_NAME] --enable-legacy-authorization
</code></pre>
