<p>I did this example <a href="https://github.com/jetstack/kube-lego/tree/master/examples/gce" rel="noreferrer">https://github.com/jetstack/kube-lego/tree/master/examples/gce</a> , then failed to create ClusterRole kube-lego.</p>

<p>The error is:</p>

<pre><code>Error from server (Forbidden): error when creating "k8s/kube-lego/hoge.yaml": clusterroles.rbac.authorization.k8s.io "kube-lego" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["create"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["delete"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["update"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["create"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["delete"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["update"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["get"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["update"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["create"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["list"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["patch"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["delete"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["watch"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["create"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["update"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["create"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["update"]}] user=&amp;{myemail@gmail.com  [system:authenticated] map[]} ownerrules=[PolicyRule{Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], APIGroups:["authorization.k8s.io"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]}] ruleResolutionErrors=[]
</code></pre>

<p>I tried on 1.8.6-gke.0, 1.8.7-gke.0 and 1.9.2-gke.0.</p>

<p>thanks.</p>

<p>As commented in <a href="https://github.com/jetstack/kube-lego/issues/225#issuecomment-313412762" rel="noreferrer"><code>kube-lego</code> issue 225</a>:</p>
<blockquote>
<p>Turns out the error I was receiving in an known issue with GKE 1.6. I resolved by following this article:</p>
<h2>get current google identity</h2>
</blockquote>
<pre><code>$ gcloud info | grep Account
Account: [myname@example.org]
</code></pre>
<blockquote>
<h2>grant cluster-admin to your current identity</h2>
</blockquote>
<pre><code>$ kubectl create clusterrolebinding myname-cluster-admin-binding --clusterrole=cluster-admin --user=myname@example.org
Clusterrolebinding &quot;myname-cluster-admin-binding&quot; created
</code></pre>
<p>For the actual RBAC to define, see <a href="https://github.com/jetstack/kube-lego/issues/99" rel="noreferrer">issue 99</a></p>
<p>It refers to <a href="https://github.com/jetstack/kube-lego/commit/22e3451ca286276d0e4746522b16dd984fb07b9a" rel="noreferrer"><strong>Adds official RBAC rules</strong></a>, which applies the right settings:</p>
<pre><code># RBAC objects
kubectl apply -f lego/service-account.yaml
kubectl apply -f lego/cluster-role.yaml
kubectl apply -f lego/cluster-role-binding.yaml
</code></pre>
