<p>I sent up a 4 node cluster (1 master 3 workers) running Kubernetes on Ubuntu. I turned on --authorization-mode=ABAC and set up a policy file with an entry like the following</p>

<blockquote>
  <p>{"user":"bob", "readonly": true, "namespace": "projectgino"}</p>
</blockquote>

<p>I want user bob to only be able to look at resources in projectgino. I'm having problems using kubectl command line as user Bob. When I run the following command </p>

<blockquote>
  <p>kubectl get pods --token=xxx --namespace=projectgino --server=<a href="https://xxx.xxx.xxx.xx:6443" rel="nofollow">https://xxx.xxx.xxx.xx:6443</a></p>
</blockquote>

<p>I get the following error</p>

<blockquote>
  <p>error: couldn't read version from server: the server does not allow access to the requested resource</p>
</blockquote>

<p>I traced the kubectl command line code and the problem seems to caused by kubectl calling function NegotiateVersion in pkg/client/helper.go. This makes a call to /api on the server to get the version of Kubernetes. This call fails because the rest path doesn't contain namespace projectgino. I added trace code to pkg/auth/authorizer/abac/abac.go and it fails on the namespace check.</p>

<p>I haven't moved up the the latest 1.1.1 version of Kubernetes yet, but looking at the code I didn't see anything that has changed in this area. </p>

<p>Does anybody know how to configure Kubernetes to get around the problem?</p>

<p>This is missing functionality in the <a href="https://github.com/kubernetes/kubernetes/blob/e024e55e8e54628e76b74b16a74435dffa761d99/pkg/auth/authorizer/abac/abac_test.go#L113" rel="nofollow">ABAC authorizer</a>. The fix is in progress: <a href="https://github.com/kubernetes/kubernetes/pull/16148" rel="nofollow">#16148</a>.</p>

<p>As for a workaround, from <a href="https://github.com/kubernetes/kubernetes/blob/release-1.0/docs/admin/authorization.md#request-attributes" rel="nofollow">the authorization doc</a>:</p>

<blockquote>
  <p>For miscellaneous endpoints, like
    /version, the resource is the empty string.</p>
</blockquote>

<p>So you may be able to solve by defining a policy:</p>

<blockquote>
  <p>{"user":"bob", "readonly": true, "resource": ""}</p>
</blockquote>

<p>(note the empty string for resource) to grant access to unversioned endpoints. If that doesn't work I don't think there's a clean workaround that will let you use kubectl with --authorization-mode=ABAC.</p>
