<p>I found a few people that tried to tackle this, only slightly relevant posts <a href="https://stackoverflow.com/questions/37786244/what-username-does-the-kubernetes-kubelet-use-when-contacting-the-kubernetes-api">here</a> and <a href="https://stackoverflow.com/questions/33790438/using-kubectl-with-kubernetes-authorization-mode-abac">here</a> but doesn't solve it for me.</p>

<p>The problem:
I want to create a read-only user for my cluster using ABAC policy.
My cluster has 3 masters and 3 workers, version 1.4.7 hosted on AWS.</p>

<p>I edited my manifests/apiserver.yml like so on all 3 masters (added these 3 lines - at the bottom of the file of course I mounted the relevant paths etc..):</p>

<ul>
<li>--token-auth-file=/etc/kubernetes/policy/user-tokens.csv</li>
<li>--authorization-mode=ABAC</li>
<li>--authorization-policy-file=/etc/kubernetes/policy/apiusers.yml</li>
</ul>

<p>my apiuser.yml looks like this:</p>

<pre><code>{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*", "namespace": "*", "resource": "*", "apiGroup": "*"}}
</code></pre>

<p>My users-token.csv looks like this:</p>

<pre><code>tdU0ynyO3wG6UAzwWP0DO7wvF2tH8pbH,bob,bob
</code></pre>

<p>My kubeconfig file has this in it:</p>

<pre><code>users:
- name: bob
  user:
    token: tdU0ynyO3wG6UAzwWP0DO7wvF2tH8pbH
</code></pre>

<p>When I try <code>kubectl get nodes</code> it's failing, I can print the output with --v=8 if it's relevant but it basically says <code>Forbidden(403)</code>.
It seems to me, I'm missing something fundamental here, the policy is in place and blocking everything and everyone, though it should allow authenticated users read only rights.</p>

<p>Any kind of help or suggestions would be most appreciated.</p>

<p>the <code>system:authenticated</code> group was added in 1.5</p>

<p>prior to 1.5, you can use <code>"user":"*"</code></p>
