<p>I'm running Kubernetes 1.6.2 with RBAC enabled. I've created a user <code>kube-admin</code> that has the following Cluster Role binding</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: k8s-admin
subjects:
- kind: User
  name: kube-admin
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>When I attempt to <code>kubectl exec</code> into a running pod I get the following error.</p>
<pre class="lang-sh prettyprint-override"><code>kubectl -n kube-system exec -it kubernetes-dashboard-2396447444-1t9jk -- /bin/bash
error: unable to upgrade connection: Forbidden (user=system:anonymous, verb=create, resource=nodes, subresource=proxy)
</code></pre>
<p>My guess is I'm missing a <code>ClusterRoleBinding</code> ref, which role am I missing?</p>

<p>The connection between kubectl and the api is fine, and is being authorized correctly.</p>

<p>To satisfy an exec request, the apiserver contacts the kubelet running the pod, and that connection is what is being forbidden.</p>

<p>Your kubelet is configured to authenticate/authorize requests, and the apiserver is not providing authentication information recognized by the kubelet.</p>

<p>The way the apiserver authenticates to the kubelet is with a client certificate and key, configured with the <code>--kubelet-client-certificate=... --kubelet-client-key=...</code> flags provided to the API server.</p>

<p>See <a href="https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#overview" rel="noreferrer">https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#overview</a> for more information. </p>
