<p>After creating a new GKE cluster, creating a cluster role failed with the following error:</p>
<pre><code>Error from server (Forbidden): error when creating &quot;./role.yaml&quot;:
clusterroles.rbac.authorization.k8s.io &quot;secret-reader&quot; is forbidden: 
attempt to grant extra privileges: [PolicyRule{Resources:[&quot;secrets&quot;], 
APIGroups:[&quot;&quot;], Verbs:[&quot;get&quot;]} PolicyRule{Resources:[&quot;secrets&quot;], 
APIGroups:[&quot;&quot;], Verbs:[&quot;watch&quot;]} PolicyRule{Resources:[&quot;secrets&quot;], 
APIGroups:[&quot;&quot;], Verbs:[&quot;list&quot;]}] user=&amp;{XXX@gmail.com  
[system:authenticated] map[authenticator:[GKE]]} ownerrules= . 
[PolicyRule{Resources:[&quot;selfsubjectaccessreviews&quot; 
&quot;selfsubjectrulesreviews&quot;], APIGroups:[&quot;authorization.k8s.io&quot;], Verbs: 
[&quot;create&quot;]} PolicyRule{NonResourceURLs:[&quot;/api&quot; &quot;/api/*&quot; &quot;/apis&quot; 
&quot;/apis/*&quot; &quot;/healthz&quot; &quot;/swagger-2.0.0.pb-v1&quot; &quot;/swagger.json&quot; 
&quot;/swaggerapi&quot; &quot;/swaggerapi/*&quot; &quot;/version&quot;], Verbs:[&quot;get&quot;]}] 
ruleResolutionErrors=[]
</code></pre>
<p>My account has the following permissions in IAM:</p>
<blockquote>
<p>Kubernetes Engine Admin</p>
<p>Kubernetes Engine Cluster Admin</p>
<p>Owner</p>
</blockquote>
<p>This is my <code>role.yaml</code> (from the <a href="https://kubernetes.io/docs/admin/authorization/rbac/#role-and-clusterrole" rel="noreferrer">Kubernetes docs)</a>:</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: secret-reader
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
</code></pre>
<p>According to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control" rel="noreferrer">RBAC docs of GCloud</a>, I need to</p>
<blockquote>
<p>create a RoleBinding that gives your Google identity a cluster-admin role before attempting to create additional Role or ClusterRole permissions.</p>
</blockquote>
<p>So I tried <a href="https://projectriff.io/docs/running-on-gke-with-rbac/" rel="noreferrer">this</a>:</p>
<pre><code>export GCP_USER=$(gcloud config get-value account | head -n 1)
kubectl create clusterrolebinding cluster-admin-binding
--clusterrole=cluster-admin --user=$GCP_USER
</code></pre>
<p>which succeeded, but I still get the same error when creating the cluster role.</p>
<p>Any ideas what I might be doing wrong?</p>

<p>According to <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control" rel="noreferrer">Google Container Engine docs</a> you must first create a RoleBinding that grants you all of the permissions included in the role you want to create.</p>

<h1>Get current google identity</h1>

<pre><code>$ gcloud info | grep Account

Account: [myname@example.org]
</code></pre>

<h1>Grant cluster-admin to your current identity</h1>

<pre><code>$ kubectl create clusterrolebinding myname-cluster-admin-binding --clusterrole=cluster-admin --user=myname@example.org

Clusterrolebinding "myname-cluster-admin-binding" created
</code></pre>

<p>Now you can create your ClusterRole without any problem.</p>

<p>I found the answer in CoreOS <a href="https://coreos.com/operators/prometheus/docs/latest/troubleshooting.html" rel="noreferrer">FAQ / Troubleshooting</a> check it out for more information.</p>
