<p>followed <a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="noreferrer">steps to create single master cluster</a>, i was able to successfully init the master, but when apply i got <strong>forbidden</strong> error, any one experienced the same? thanks!</p>

<p>i did the following</p>

<pre><code>1. disable selinux in /etc/selinux/config, and reboot
2. comment out KUBELET_NETWORK_ARGS in 
         /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
3. export no_proxy=$no_proxy,&lt;master-ip&gt; 
4. export KUBECONFIG=/etc/kubernetes/kubelet.conf in .bash_profile
</code></pre>

<p>after init success, when try to apply </p>

<pre><code>kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml
</code></pre>

<p>i got below error messages</p>

<pre><code>Error from server (Forbidden): error when retrieving current configuration of:
&amp;{0xc42048ab40 0xc421a83730  
flannel https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml 0xc42109cc20  false}
from server for: "https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml": 
clusterroles.rbac.authorization.k8s.io "flannel" is forbidden: 
User "system:node:&lt;master-server-name&gt;" 
cannot get clusterroles.rbac.authorization.k8s.io at the cluster scope
</code></pre>

<p>As soon as your cluster is not yet fully functional, it would be easier to tear it down and recreate from scratch:</p>

<h3>Tear down everything:</h3>

<pre><code>$&gt; sudo su
#&gt; kubeadm reset
#&gt; rm -rf $HOME/.kube /etc/kubernetes
</code></pre>

<h3>Prepare your host (just in case you haven’t  done it already):</h3>

<pre><code>#&gt; swapoff -a
## Don't forget to comment swap partition line in /etc/fstab

## I assume that you have these packages already installed: docker, kubeadm, kubectl

## tune sysctl to pass bridged IPv4 traffic to iptables’ chains. 
## This is a requirement for some CNI plugins to work, for more information please see
## https://kubernetes.io/docs/concepts/cluster-administration/network-plugins/#network-plugin-requirements

#&gt; cat &lt;&lt;EOF &gt;&gt;/etc/ufw/sysctl.conf
net/bridge/bridge-nf-call-ip6tables = 1
net/bridge/bridge-nf-call-iptables = 1
net/bridge/bridge-nf-call-arptables = 1
EOF
#&gt; sudo sysctl --system
</code></pre>

<h3>Initialize the cluster:</h3>

<pre><code>## Do not try to set less than /16 subnet for `--pod-network-cidr`

#&gt; kubeadm init --pod-network-cidr=10.244.0.0/16

## Prepare the kubectl config

#&gt; mkdir -p $HOME/.kube
#&gt; cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
#&gt; chown $(id -u):$(id -g) $HOME/.kube/config
</code></pre>

<h3>Install Flannel</h3>

<pre><code>#&gt; kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml
</code></pre>

<h3>Allow pod scheduled on the master node.</h3>

<p>(Just in case you do not have any worker nodes.)</p>

<pre><code>#&gt; kubectl taint nodes --all node-role.kubernetes.io/master-
</code></pre>

<h3>At this point you should have ready-to-use Kubernetes cluster:</h3>

<pre><code>#&gt; kubectl get nodes
#&gt; kubectl get pods --all-namespaces
</code></pre>
