<p>So I've been trying to implement ABAC authorization in the kubernetes API, with the following arguments in my kube-api manifest file.</p>

<pre><code>  - --authorization-mode=ABAC
  - --authorization-policy-file=/etc/kubernetes/auth/abac-rules.json
</code></pre>

<p>And the following content in the abac-rulse.json file.</p>

<pre><code>{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"*",         "nonResourcePath": "*", "readonly": true}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"admin",     "namespace": "*",              "resource": "*",         "apiGroup": "*"                   }}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"scheduler", "apiGroup": "*", "namespace": "*", "resource": "*", "readonly": false}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubelet", "apiGroup": "*",   "namespace": "*", "resource": "*", "readonly": false }}
</code></pre>

<p>However, the kubelets can't seem to connect to the api servers. I read that the username is taken from the CN field of the -subject in the certificate used to authenticate the connection, <a href="http://kubernetes.io/docs/admin/authentication/" rel="nofollow">see here</a>. In this case that's the fqdn of the hose, i've tried that too with no luck.</p>

<p>Any ideas what i'm doing wrong?</p>

<p>Cheers in advance</p>

<p>Edit:</p>

<p>I'm using Kubernetes version 1.2.2, both kubectl and hyperkube docker image.</p>

<p>Figured out the answer, documenting here for anyone else having the same issue with ABAC.</p>

<p>The kubelet user is define in the worker configuration, which in my case is a yaml file which i store here - <code>/etc/kubernetes/worker-kubeconfig.yaml</code>, the content of which is shown below:</p>

<pre><code>apiVersion: v1
kind: Config
clusters:
- name: default
  cluster:
    server: https://10.96.17.34:8443
    certificate-authority: /etc/kubernetes/ssl/ca.pem
users:
- name: kubelet
  user:
    client-certificate: /etc/kubernetes/ssl/worker.pem
    client-key: /etc/kubernetes/ssl/worker-key.pem
contexts:
- context:
    cluster: default
    user: kubelet
  name: kubelet-context
current-context: kubelet-context
</code></pre>

<p>So the user it's connecting with is <code>kubelet</code>.</p>

<p>In my case I had create my certificates with the CN=${MINION_FQDN}, and since this did not match "kubelet" then the ABAC policies weren't met. I regenerated my certifcates with the following arguments and now the nodes authenticate succesfully :) </p>

<pre><code># Create worker key
openssl genrsa -out $OUT/${WORKER_HOSTNAME}/worker-key.pem 2048
#Creating Worker CSR...
WORKER_FQDN=${WORKER_FQDN} WORKER_IP=${WORKER_IP} openssl req -new -key $OUT/${WORKER_HOSTNAME}/worker-key.pem -out $OUT/${WORKER_HOSTNAME}/worker.csr -subj "/CN=kubelet" -config $SSL_CONFIG
# Creating Worker Cert
WORKER_FQDN=${WORKER_FQDN} WORKER_IP=${WORKER_IP} openssl x509 -req -in $OUT/${WORKER_HOSTNAME}/worker.csr -CA $CA/ca.pem -CAkey $CA/ca-key.pem -CAcreateserial -out $OUT/${WORKER_HOSTNAME}/worker.pem -days 365 -extensions v3_req -extfile $SSL_CONFIG
</code></pre>

<p>The important part of which is this:</p>

<pre><code>-subj "/CN=kubelet"
</code></pre>

<p>Hope this helps someone else.</p>
