<p>I am having trouble enabling webhook authentication for the kubelet API. My cluster is deployed with kubeadm. <a href="https://stackoverflow.com/questions/44855609/enabling-kubelet-server-bearer-token-authentication">This post is similar, but not the same issue</a></p>

<p>I can authenticate to my API server with a bearer token just fine:</p>

<pre><code>curl -k https://localhost:6443/api --header "Authorization: Bearer $TOKEN"
</code></pre>

<p>I cannot authenticate against the kubelet api with the same header. I have enabled the following on the API server:</p>

<pre><code>--authorization-mode=Node,RBAC
--anonymous-auth=false
--runtime-config=authentication.k8s.io/v1beta1=true,authorization.k8s.io/v1beta1=true
</code></pre>

<p>The following is enabled on the kubelet node(s) (via /var/lib/kubelet/config.yaml)</p>

<pre><code>address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
</code></pre>

<p>Despite this, I get a "403 forbidden" when curling the /metrics endpoint on the kubelet. Something to note, I can perform the same API call against a cluster deployed with KOPS just fine. I am not sure what the difference is. </p>

<p>The 403 indicates you successfully authenticated (or you would have gotten a 401 error), the kubelet checked with the apiserver if you were authorized to access kubelet metrics (otherwise it would have just allowed it), it got a definitely response from the apiserver (otherwise you would have gotten a 500 error), and the apiserver indicated the authenticated user is not authorized to access kubelet metrics. </p>

<p>See <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/#kubelet-authorization" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/#kubelet-authorization</a> for details about what permission needs to be granted to access various endpoints on the kubelet's API. For metrics, the <code>nodes/metrics</code> resource in the <code>""</code> apiGroup must be granted. </p>
