<p><code>kube-apiserver.service</code> is running with <code>--authorization-mode=Node,RBAC</code></p>

<pre><code>$ kubectl api-versions | grep rbac
rbac.authorization.k8s.io/v1
rbac.authorization.k8s.io/v1beta1
</code></pre>

<p>Believe this is enough to enable RBAC. </p>

<p>However, any new user i create can view all resources without any rolebindings. </p>

<p><strong>Steps to create new user:</strong></p>

<pre><code>$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes nonadmin-csr.json | cfssljson -bare nonadmin
$ kubectl config set-cluster nonadmin --certificate-authority ca.pem --server https://127.0.0.1:6443
$ kubectl config set-credentials nonadmin --client-certificate nonadmin.pem --client-key nonadmin-key.pem
$ kubectl config set-context nonadmin --cluster nonadmin --user nonadmin
$ kubectl config use-context nonadmin
</code></pre>

<p>User <code>nonadmin</code> can view pods, svc without any rolebindings</p>

<pre><code>$ kubectl get svc --all-namespaces
NAMESPACE       NAME                      TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)                      AGE                 
default         kubernetes                ClusterIP   10.32.0.1     &lt;none&gt;        443/TCP                      5d4h
ingress-nginx   ingress-nginx             NodePort    10.32.0.129   &lt;none&gt;        80:30989/TCP,443:30686/TCP   5d3h
kube-system     calico-typha              ClusterIP   10.32.0.225   &lt;none&gt;        5473/TCP                     5d3h
kube-system     kube-dns                  ClusterIP   10.32.0.10    &lt;none&gt;        53/UDP,53/TCP                5d3h
rook-ceph       rook-ceph-mgr             ClusterIP   10.32.0.2     &lt;none&gt;        9283/TCP                     4d22h
rook-ceph       rook-ceph-mgr-dashboard   ClusterIP   10.32.0.156   &lt;none&gt;        8443/TCP                     4d22h
rook-ceph       rook-ceph-mon-a           ClusterIP   10.32.0.55    &lt;none&gt;        6790/TCP                     4d22h
rook-ceph       rook-ceph-mon-b           ClusterIP   10.32.0.187   &lt;none&gt;        6790/TCP                     4d22h
rook-ceph       rook-ceph-mon-c           ClusterIP   10.32.0.128   &lt;none&gt;        6790/TCP                     4d22h
</code></pre>

<p><strong>Version:</strong></p>

<pre><code>$ kubectl version
Client Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.2", GitCommit:"cff46ab41ff0bb44d8584413b598ad8360ec1def", GitTreeState:"clean", BuildDate:"2019-01-10T23:35:51Z", GoVersion:"go1.11.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.2", GitCommit:"cff46ab41ff0bb44d8584413b598ad8360ec1def", GitTreeState:"clean", BuildDate:"2019-01-10T23:28:14Z", GoVersion:"go1.11.4", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>This is an unmanaged kubernetes setup on Ubuntu 18 VMs.
Where am i going wrong?</p>

<p><strong>Edit1:</strong> Adding <code>kubectl config view</code></p>

<pre><code>$ kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority: /home/dadmin/ca.pem
    server: https://192.168.1.111:6443
  name: gabbar
- cluster:
    certificate-authority: /home/dadmin/ca.pem
    server: https://127.0.0.1:6443
  name: nonadmin
- cluster:
    certificate-authority: /home/dadmin/ca.pem
    server: https://192.168.1.111:6443
  name: kubernetes
contexts:
- context:
    cluster: gabbar
    namespace: testing
    user: gabbar
  name: gabbar
- context:
    cluster: nonadmin
    user: nonadmin
  name: nonadmin
- context:
    cluster: kubernetes
    user: admin
  name: kubernetes
current-context: nonadmin
kind: Config
preferences: {}
users:
- name: admin
  user:
    client-certificate: /home/dadmin/admin.pem
    client-key: /home/dadmin/admin-key.pem
- name: gabbar
  user:
    client-certificate: /home/dadmin/gabbar.pem
    client-key: /home/dadmin/gabbar-key.pem
- name: nonadmin
  user:
    client-certificate: /home/dadmin/nonadmin.pem
    client-key: /home/dadmin/nonadmin-key.pem
</code></pre>

<p><strong>Edit 2:</strong>
<strong>Solution</strong> as suggested by @VKR:</p>

<pre><code>cat &gt; operator-csr.json &lt;&lt;EOF
{
  "CN": "operator",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "IN",
      "L": "BGLR",
      "O": "system:view",  &lt;==== HERE
      "OU": "CKA"
    }
  ]
}
EOF

cfssl gencert \
  -ca=ca.pem \
  -ca-key=ca-key.pem \
  -config=ca-config.json \
  -profile=kubernetes \
  operator-csr.json | cfssljson -bare operator

MasterNode~$ kubectl config set-cluster operator --certificate-authority ca.pem --server $SERVER
Cluster "operator" set.

MasterNode~$ kubectl config set-credentials operator --client-certificate operator.pem --client-key operator-key.pem
User "operator" set.

MasterNode~$ kubectl config set-context operator --cluster operator --user operator
Context "operator" created.

MasterNode~$ kubectl auth can-i get pods --as operator
no

MasterNode~$ kubectl create rolebinding operator --clusterrole view --user operator -n default --save-config
rolebinding.rbac.authorization.k8s.io/operator created

MasterNode~$ cat crb-view.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: view
subjects:
- kind: User
  name: operator
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io

MasterNode~$ kubectl create -f crb-view.yml --record --save-config
clusterrolebinding.rbac.authorization.k8s.io/view created

MasterNode~$ kubectl auth can-i get pods --as operator --all-namespaces
yes

MasterNode~$ kubectl auth can-i create pods --as operator --all-namespaces
no

MasterNode~$ kubectl config use-context operator
Switched to context "operator".

MasterNode~$ kubectl auth can-i "*" "*"
no

MasterNode~$ kubectl run db --image mongo
kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.
Error from server (Forbidden): deployments.apps is forbidden: User "operator" cannot create resource "deployments" in API group "apps" in the namespace "default"
</code></pre>

<p>Most probably root cause of such behavior is that use set  <code>"O": "system:masters"</code> group while generating <code>nonadmin-csr.json</code></p>

<p><code>system:masters</code> group bounds to the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings" rel="nofollow noreferrer">cluster-admin super-user default role</a> and as a result -  every newly created user will have full access.</p>

<p>Here is a good <a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">article</a> that provide you step-by-step instruction on how to create users with limited namespace access.</p>

<p>Quick test shows that similar users but with different groups have huge access differences</p>

<p>-subj "/CN=employee/O=testgroup" :</p>

<pre><code>kubectl --context=employee-context get pods --all-namespaces
Error from server (Forbidden): pods is forbidden: User "employee" cannot list resource "pods" in API group "" at the cluster scope
</code></pre>

<p>-subj "/CN=newemployee/O=system:masters" :</p>

<pre><code>kubectl --context=newemployee-context get pods --all-namespaces
NAMESPACE       NAME                                        READY   STATUS    RESTARTS   AGE
ingress-nginx   nginx-ingress-controller-797b884cbc-pckj6   1/1     Running   0          85d
ingress-nginx   prometheus-server-8658d8cdbb-92629          1/1     Running   0          36d
kube-system     coredns-86c58d9df4-gwk28                    1/1     Running   0          92d
kube-system     coredns-86c58d9df4-jxl84                    1/1     Running   0          92d
kube-system     etcd-kube-master-1                          1/1     Running   0          92d
kube-system     kube-apiserver-kube-master-1                1/1     Running   0          92d
kube-system     kube-controller-manager-kube-master-1       1/1     Running   4          92d
kube-system     kube-flannel-ds-amd64-k6sgd                 1/1     Running   0          92d
kube-system     kube-flannel-ds-amd64-mtrnc                 1/1     Running   0          92d
kube-system     kube-flannel-ds-amd64-zdzjl                 1/1     Running   1          92d
kube-system     kube-proxy-4pm27                            1/1     Running   1          92d
kube-system     kube-proxy-ghc7w                            1/1     Running   0          92d
kube-system     kube-proxy-wsq4h                            1/1     Running   0          92d
kube-system     kube-scheduler-kube-master-1                1/1     Running   4          92d
kube-system     tiller-deploy-5b7c66d59c-6wx89              1/1     Running   0          36d
</code></pre>
