<p>I tried <code>kubectl exec</code> on a k8s 1.6.4 RBAC-enabled cluster and the error returned was: <code>error: unable to upgrade connection: Unauthorized</code>. <code>docker exec</code> on the same container succeeds. Otherwise, <code>kubectl</code> is working. <code>kubectl</code> tunnels through an SSH connection but I don't think this is the issue.</p>

<p>kubelet authn is enabled but not authz. The <a href="https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization" rel="noreferrer">docs</a> say that authz is AlwaysAllow by default, so I have left it this way.</p>

<p>I have a feeling that it is similar to <a href="https://stackoverflow.com/questions/44312745/kubernetes-rbac-unable-to-upgrade-connection-forbidden-user-systemanonymous">this issue</a>. But the error message is a tad different.</p>

<p>Thanks in advance!</p>

<p>Verbose logs for the <code>kubectl exec</code> command:</p>

<pre><code>I0614 16:50:11.003677   64104 round_trippers.go:398] curl -k -v -XPOST  -H "X-Stream-Protocol-Version: v4.channel.k8s.io" -H "X-Stream-Protocol-Version: v3.channel.k8s.io" -H "X-Stream-Protocol-Version: v2.channel.k8s.io" -H "X-Stream-Protocol-Version: channel.k8s.io" https://localhost:6443/api/v1/namespaces/monitoring/pods/alertmanager-main-0/exec?command=%2Fbin%2Fls&amp;container=alertmanager&amp;container=alertmanager&amp;stderr=true&amp;stdout=true
I0614 16:50:11.003705   64104 round_trippers.go:398] curl -k -v -XPOST  -H "X-Stream-Protocol-Version: v4.channel.k8s.io" -H "X-Stream-Protocol-Version: v3.channel.k8s.io" -H "X-Stream-Protocol-Version: v2.channel.k8s.io" -H "X-Stream-Protocol-Version: channel.k8s.io" -H "User-Agent: kubectl/v1.6.4 (darwin/amd64) kubernetes/d6f4332" https://localhost:6443/api/v1/namespaces/monitoring/pods/alertmanager-main-0/exec?command=%2Fbin%2Fls&amp;container=alertmanager&amp;container=alertmanager&amp;stderr=true&amp;stdout=true
I0614 16:50:11.169474   64104 round_trippers.go:417] POST https://localhost:6443/api/v1/namespaces/monitoring/pods/alertmanager-main-0/exec?command=%2Fbin%2Fls&amp;container=alertmanager&amp;container=alertmanager&amp;stderr=true&amp;stdout=true 401 Unauthorized in 165 milliseconds
I0614 16:50:11.169493   64104 round_trippers.go:423] Response Headers:
I0614 16:50:11.169497   64104 round_trippers.go:426]     Date: Wed, 14 Jun 2017 08:50:11 GMT
I0614 16:50:11.169500   64104 round_trippers.go:426]     Content-Length: 12
I0614 16:50:11.169502   64104 round_trippers.go:426]     Content-Type: text/plain; charset=utf-8
I0614 16:50:11.169506   64104 round_trippers.go:417] POST https://localhost:6443/api/v1/namespaces/monitoring/pods/alertmanager-main-0/exec?command=%2Fbin%2Fls&amp;container=alertmanager&amp;container=alertmanager&amp;stderr=true&amp;stdout=true 401 Unauthorized in 165 milliseconds
I0614 16:50:11.169509   64104 round_trippers.go:423] Response Headers:
I0614 16:50:11.169512   64104 round_trippers.go:426]     Date: Wed, 14 Jun 2017 08:50:11 GMT
I0614 16:50:11.169545   64104 round_trippers.go:426]     Content-Length: 12
I0614 16:50:11.169548   64104 round_trippers.go:426]     Content-Type: text/plain; charset=utf-8
F0614 16:50:11.169635   64104 helpers.go:119] error: unable to upgrade connection: Unauthorized
</code></pre>

<p>This is an RTFM moment... The solution was basically to follow all the steps on <a href="https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization" rel="noreferrer">this page</a> for authn, authz, or both.</p>

<p>I had omitted <code>--kubelet-client-certificate</code> and <code>--kubelet-client-key</code> which resulted in the error. Without these flags, <code>kube-apiserver</code> will fail to authenticate with kubelet when you do a <code>kubectl exec</code>.</p>

<p>My original attempt to configure authn was by reading the docs for the kubelet daemon (ie. not the one above). Hence the grave omission.</p>
