<p>while testing the role based access in the Alibaba container service it's throwing with me an error <strong>"pods is forbidden: User "user1" cannot list pods in the namespace "stage""</strong> this is RBAC issue, which i'm not able to figure it where i'm heading it wrong</p>

<p><strong>The RoleBinding Definition</strong></p>

<pre><code>root@kube-master:# kubectl describe rolebinding stage-role-binding  -n stage
Name:         stage-role-binding
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Role:
  Kind:  Role
  Name:  staging
Subjects:
  Kind  Name   Namespace
  ----  ----   ---------
  User  user2  
</code></pre>

<p><strong>The Role Definition</strong></p>

<pre><code>root@kube-master:# kubectl describe role -n stage
Name:         staging
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources               Non-Resource URLs  Resource Names  Verbs
  ---------               -----------------  --------------  -----
  deployments             []                 []              [get list watch create update patch delete]
  pods                    []                 []              [get list watch create update patch delete]
  replicasets             []                 []              [get list watch create update patch delete]
  deployments.apps        []                 []              [get list watch create update patch delete]
  pods.apps               []                 []              [get list watch create update patch delete]
  replicasets.apps        []                 []              [get list watch create update patch delete]
  deployments.extensions  []                 []              [get list watch create update patch delete]
  pods.extensions         []                 []              [get list watch create update patch delete]
  replicasets.extensions  []                 []              [get list watch create update patch delete]
</code></pre>

<p><strong>One pod is running well in the stage namespace</strong></p>

<pre><code>root@kube-master:# kubectl get pods -n stage 
NAME      READY     STATUS    RESTARTS   AGE
busybox   1/1       Running   0          10m
</code></pre>

<p><strong>Defining context</strong></p>

<pre><code>root@kube-master:# kubectl config set-context stage --cluster=kubernetes --namespace=stage --user=user2
Context "stage" modified.
</code></pre>

<p><strong>Testing RBAC</strong></p>

<pre><code>root@kube-master:/home/ansible# kubectl --context=stage get pods
No resources found.
Error from server (Forbidden): pods is forbidden: User "user1" cannot list pods in the namespace "stage"
</code></pre>

<p>Not sure from where <strong>user1</strong> </p>

<blockquote>
  <p>is coming and throwing the RBAC Error</p>
</blockquote>

<p>There is only <strong>context</strong> is set for <strong>user2</strong></p>

<pre><code>root@kube-master:# kubectl config get-contexts
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin   
          stage                         kubernetes   user2              stage
</code></pre>

<p><strong>This is how i created the user</strong></p>

<pre><code>openssl genrsa -out user2.key 2048
openssl req -new -key user2.key -out user2.csr -subj "/CN=user1/O=8gwifi.org"
openssl x509 -req -in user2.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out user2.crt -days 500

kubectl config set-credentials user2 --client-certificate=user2.crt --client-key=user2.key
kubectl config set-context stage --cluster=kubernetes --namespace=stage --user=user2
</code></pre>

<p>The RoleBinding is for user <strong>user2</strong>, not for <strong>user1</strong>. That's why you are getting RBAC error.</p>

<p>Setting context for user <strong>user2</strong> does not mean that kubernetes will identify this user as <strong>user2</strong>. It depends on the credential you use. If the used credential is of user <strong>user-x</strong>, then kubernetes will treat it as <strong>user-x</strong>. The <strong>context user</strong> is for kubectl to find user credential info. To understand kubernetes authentication see <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">here</a>.</p>

<p>The credential you used there resolved to user <strong>user1</strong>. So you should update your RoleBinding to <strong>user1</strong>.</p>

<p><strong>After updated question</strong></p>

<p>For certificate authetication, <strong>CN</strong> will be the username (ref: <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#x509-client-certs" rel="nofollow noreferrer">here</a>).
In your certificate <code>"/CN=user1/O=8gwifi.org"</code>, so username will be <strong>user1</strong> not <strong>user2</strong>.</p>
