<p>I've just created a new cluster using Google Container Engine running Kubernetes 1.7.5, with the new RBAC permissions enabled. I've run into a problem allocating permissions for some of my services which lead me to the following:</p>

<p>The <a href="https://cloud.google.com/container-engine/docs/role-based-access-control" rel="noreferrer">docs</a> for using container engine with RBAC state that the user must be granted the ability to create authorization roles by running the following command:</p>

<pre><code>kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin [--user=&lt;user-name&gt;]
</code></pre>

<p>However, this fails due to lack of permissions (which I would assume are the very same permissions which we are attempting to grant by running the above command).</p>

<pre><code>Error from server (Forbidden): 
User "&lt;user-name&gt;" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope.: 
  "Required \"container.clusterRoleBindings.create\" permission." 
  (post clusterrolebindings.rbac.authorization.k8s.io)
</code></pre>

<p>Any help would be much appreciated as this is blocking me from creating the permissions needed by my cluster services.</p>

<p>Janos's answer will work for GKE clusters that have been created with a password, but I'd recommend avoiding using that password wherever possible (or creating your GKE clusters without a password).</p>

<p>Using IAM: To create that <code>ClusterRoleBinding</code>, the caller must have the <code>container.clusterRoleBindings.create</code> permission. Only the <code>OWNER</code> and <code>Kubernetes Engine Admin</code> IAM Roles contain that permission (because it allows modification of access control on your GKE clusters).</p>

<p>So, to allow <code>person@company.com</code> to run that command, they must be granted one of those roles. E.g.:</p>

<pre><code>gcloud projects add-iam-policy-binding $PROJECT \
  --member=user:person@company.com \
  --role=roles/container.admin
</code></pre>
