<p>I'm running a gke 1.8.4 cluster, and seeing an issue with requests to access resources being permitted, even though RBAC is denying them</p>

<p>from logs/kube-apiserver.log (I've replaced my username and the username I'm impersonating, in &lt;<em>italics</em>>):</p>

<blockquote>
  <p>I1218 13:30:38.644205       5 httplog.go:64] &amp;{&lt;<em>my_user</em>>  [system:authenticated] map[]} is acting as &amp;{&lt;<em>other_user</em>>  [system:authenticated] map[]}<br/><br/>
  I1218 13:30:38.644297       5 rbac.go:116] RBAC DENY: user "&lt;<em>other_user</em>>" groups ["system:authenticated"] cannot "list" resource "secrets" in namespace "prod"<br/><br/>
  I1218 13:30:38.676079       5 wrap.go:42] GET /api/v1/namespaces/prod/secrets: (32.043196ms) 200 [[kubectl/v1.8.4 (linux/amd64) kubernetes/9befc2b]</p>
</blockquote>

<p>Why is the api proceeding to the GET after the RBAC DENY (and ultimately returning the secrets in response to my kubectl cmd)?</p>

<p>fwiw my kubectl cmd is: <code>kubectl get secrets --namespace prod --as &lt;other_user&gt;</code></p>

<p>I suspect there's another authorizer that's allowing it, though I've done everything I know of to ensure there isn't (ABAC should be disabled, as I'm on 1.8, the google cloud console shows it as being disabled, and I'm seeing "legacyAbac: {}" in the response from <em>gcloud beta container clusters describe</em>)</p>

<p>GKE enables both the RBAC authorizer and a webhook authorizer that consults GKE IAM. Does the specified username have permissions via GKE?</p>
