<p>I was trying to deploy Istio in my environment and run across the following error.  All the solutions online are regarding clusterrolebinding, I have tried to do that but failed nevertheless. Any inputs to my problem?</p>

<p><strong>kubectl api-versions | grep rbac</strong></p>

<pre><code>rbac.authorization.k8s.io/v1alpha1
rbac.authorization.k8s.io/v1beta1
</code></pre>

<p><strong>sudo kubectl apply -f install/kubernetes/istio-rbac-beta.yaml</strong></p>

<pre><code>rolebinding "istio-pilot-admin-role-binding" configured
rolebinding "istio-ca-role-binding" configured
rolebinding "istio-ingress-admin-role-binding" configured
rolebinding "istio-sidecar-role-binding" configured

Error from server (Forbidden): 
error when creating"install/kubernetes/istio-rbac-beta.yaml": 
clusterroles.rbac.authorization.k8s.io "istio-pilot" is forbidden:
attempt to grant extra privileges: [{[*] [istio.io] [istioconfigs] [] 
[]} {[*] [istio.io] [istioconfigs.istio.io] [] []} {[*] [extensions] 
[thirdpartyresources] [] []} {[*] [extensions] 
[thirdpartyresources.extensions] [] []} {[*] [extensions] [ingresses] 
[] []} {[*] [] [configmaps] [] []} {[*] [] [endpoints] [] []} {[*] [] 
[pods] [] []} {[*] [] [services] [] []}] user=&amp;{kubeconfig  
[system:authenticated] map[]} ownerrules=[] ruleResolutionErrors=[]

Error from server (Forbidden): error when creating 
"install/kubernetes/istio-rbac-beta.yaml": 
clusterroles.rbac.authorization.k8s.io "istio-ca" is forbidden: 
attempt to grant extra privileges: [{[create] [] [secrets] [] []} 
{[get] [] [secrets] [] []} {[watch] [] [secrets] [] []} {[list] [] 
[secrets] [] []} {[watch] [] [serviceaccounts] [] []} {[list] [] 
[serviceaccounts] [] []}] user=&amp;{kubeconfig  [system:authenticated] 
map[]} ownerrules=[] ruleResolutionErrors=[]

Error from server (Forbidden): error when creating 
"install/kubernetes/istio-rbac-beta.yaml": 
clusterroles.rbac.authorization.k8s.io "istio-sidecar" is forbidden: 
attempt to grant extra privileges: [{[get] [istio.io] [istioconfigs] [] 
[]} {[watch] [istio.io] [istioconfigs] [] []} {[list] [istio.io] 
[istioconfigs] [] []} {[get] [extensions] [thirdpartyresources] [] []} 
{[watch] [extensions] [thirdpartyresources] [] []} {[list] [extensions] 
[thirdpartyresources] [] []} {[update] [extensions] 
[thirdpartyresources] [] []} {[get] [extensions] [ingresses] [] []} 
{[watch] [extensions] [ingresses] [] []} {[list] [extensions] 
[ingresses] [] []} {[update] [extensions] [ingresses] [] []} {[get] [] 
[configmaps] [] []} {[watch] [] [configmaps] [] []} {[list] [] 
[configmaps] [] []} {[get] [] [pods] [] []} {[watch] [] [pods] [] []} 
{[list] [] [pods] [] []} {[get] [] [endpoints] [] []} {[watch] [] 
[endpoints] [] []} {[list] [] [endpoints] [] []} {[get] [] [services] 
[] []} {[watch] [] [services] [] []} {[list] [] [services] [] []}] 
user=&amp;{kubeconfig  [system:authenticated] map[]} ownerrules=[] 
ruleResolutionErrors=[]
</code></pre>

<p>The error Kubernetes gives you basically means that it thinks whatever you're trying to do is a privilege escalation (which is correct) and tries to prevent that.</p>

<blockquote>
  <p>The RBAC API prevents users from escalating privileges by editing roles or role bindings. Because this is enforced at the API level, it applies even when the RBAC authorizer is not in use.
  A user can only create/update a role if they already have all the permissions contained in the role, at the same scope as the role (cluster-wide for a ClusterRole, within the same namespace or cluster-wide for a Role). For example, if “user-1” does not have the ability to list secrets cluster-wide, they cannot create a ClusterRole containing that permission.
  (taken from <a href="https://kubernetes.io/docs/admin/authorization/rbac/#privilege-escalation-prevention-and-bootstrapping" rel="nofollow noreferrer">here</a>)</p>
</blockquote>

<p>The reason for that is because the ClusterRole that is applied (using a ClusterRoleBinding) to the user you're using to access the cluster does not actually have all the permissions you're trying to give your application. To resolve that, you need to create a ClusterRoleBinding that gives your User the necessary permissions. In your case it would make sense to bind you to the cluster-admin role which gives you unlimited permissions.</p>

<p>To do that, you can run something like that:</p>

<pre><code>kubectl create clusterrolebinding --clusterrole cluster-admin --user your-user
</code></pre>
