<p>Scenario:</p>
<p>I have two Kubernetes 1.17 clusters, and one cluster have HashiCorp vault configured. I am trying to connect to it from other cluster using kubernetes auth method and I am getting <strong>403</strong> error as below:</p>
<blockquote>
<p>2020-08-11T14:22:46.971Z [ERROR] auth.kubernetes.auth_kubernetes_f530e086: login unauthorized due to: {&quot;kind&quot;:&quot;Status&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{},&quot;status&quot;:&quot;Failure&quot;,&quot;message&quot;:&quot;tokenreviews.authentication.k8s.io is forbidden: User &quot;system:serviceaccount:default:vault-auth&quot; cannot create resource &quot;tokenreviews&quot; in API group &quot;authentication.k8s.io&quot; at the cluster scope: RBAC: clusterrole.rbac.authorization.k8s.io &quot;system:auth-delegator&quot; not found&quot;,&quot;reason&quot;:&quot;Forbidden&quot;,&quot;details&quot;:{&quot;group&quot;:&quot;authentication.k8s.io&quot;,&quot;kind&quot;:&quot;tokenreviews&quot;},&quot;code&quot;:403}</p>
</blockquote>
<p>Clusterrolebinding:</p>
<pre><code>kind: ClusterRoleBinding
metadata:
  name: role-tokenreview-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: vault-auth
  namespace: default
</code></pre>
<p>Someone please help me here? What am I missing?</p>

<p>The clusterrole <code>system:auth-delegator</code> does not exist which is giving this error.</p>
<p>To check if it exists use below command</p>
<pre><code>kubectl get clusterrole | grep system:auth-delegator
</code></pre>
<p>If it does not exist create one using below yaml</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: system:auth-delegator
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
</code></pre>
