<p>In <a href="https://kubernetes.io/docs/admin/authorization/rbac/" rel="nofollow noreferrer">this</a> documentation of Kubernetes is says:</p>

<pre><code>To enable RBAC, start the apiserver with --authorization-mode=RBAC
</code></pre>

<p>How do you upgrade an existing cluster and/or how to see if RBAC is enabled?</p>

<p>I have created my cluster on Google k8 clusters and only have kubectl.</p>

<p>I have seen <a href="https://stackoverflow.com/questions/46552593/enabling-rbac-on-kubernetes-on-azure">this</a> but it kind of did not help.</p>

<p>Could you SSH to the master node/nodes and edit <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> </p>

<p>You should see something like below in the file ></p>

<pre><code>command:
    - "/hyperkube"
    - "apiserver"
    - "--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
    - "--address=0.0.0.0"
    - "--allow-privileged"
    - "--insecure-port=8080"
    - "--secure-port=443"
    - "--cloud-provider=azure"
    - "--cloud-config=/etc/kubernetes/azure.json"
    - "--service-cluster-ip-range=10.0.0.0/16"
    - "--etcd-servers=http://127.0.0.1:2379"
    - "--etcd-quorum-read=true"
    - "--advertise-address=10.240.255.15"
    - "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt"
    - "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key"
    - "--client-ca-file=/etc/kubernetes/certs/ca.crt"
    - "--service-account-key-file=/etc/kubernetes/certs/apiserver.key"
    - "--storage-backend=etcd2"
    - "--v=4" 
</code></pre>

<p>Just add <code>--authorization-mode=RBAC</code> and reboot the node and it should work.</p>

<p>Something like </p>

<pre><code>command:
        - "/hyperkube"
        - "apiserver"
        - "--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota"
        - "--address=0.0.0.0"
        - "--allow-privileged"
        - "--insecure-port=8080"
        - "--secure-port=443"
        - "--cloud-provider=azure"
        - "--cloud-config=/etc/kubernetes/azure.json"
        - "--service-cluster-ip-range=10.0.0.0/16"
        - "--etcd-servers=http://127.0.0.1:2379"
        - "--etcd-quorum-read=true"
        - "--advertise-address=10.240.255.15"
        - "--tls-cert-file=/etc/kubernetes/certs/apiserver.crt"
        - "--tls-private-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--client-ca-file=/etc/kubernetes/certs/ca.crt"
        - "--service-account-key-file=/etc/kubernetes/certs/apiserver.key"
        - "--storage-backend=etcd2"
        - "--v=4"
        - "--authorization-mode=RBAC"
</code></pre>

<p>Note that is this surely not official way but it did work for me running Kubernetes 1.8</p>
