<p>I'm trying to deploy my web service to Google Container Engine:</p>
<p>Here's my <strong>deployment.yaml:</strong></p>
<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: handfree
  labels:
    app: handfree
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: handfree
    spec:
      containers:
      - name: handfree
        image: arycloud/mysecretrepo:latest
        imagePullPolicy: Always
        #Ports to expose
        ports:
        - name: api_port
          containerPort: 8000 
</code></pre>
<p>Here's my <strong>service.yaml:</strong></p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  #Service name
  name: judge
spec:
  selector:
    app: handfree
  ports:
    - protocol: TCP
      port: 8000
      targetPort: 8000
  type: LoadBalancer  
</code></pre>
<p>I have created a cluster on Google Container Engine with cluster size 4 and 8 vCPUs, I have successfully get credentials by using the command from connecting link of this cluster.</p>
<p>When I try to run the deployment.yml it returns an error as:</p>
<blockquote>
<p>Error from server (Forbidden): error when retrieving current configuration of: default handfree    deployment.yaml</p>
<p>from server for: &quot;deployment.yaml&quot; deployments.extensions &quot;handfree&quot; is forbidden: User &quot;client&quot; cannot get deployments.extensions in the namespace &quot;default&quot;: Unknown user &quot;client&quot;.</p>
</blockquote>
<p>I'm new to kubernetes world, help me, please!</p>
<p>Thanks in advance!</p>

Abdul Rehman
<blockquote>
  <p>Unknown user "client".</p>
</blockquote>

<p>Means there is no <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#rolebinding-v1-rbac-authorization-k8s-io" rel="nofollow noreferrer"><code>RoleBinding</code></a> or <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#clusterrolebinding-v1-rbac-authorization-k8s-io" rel="nofollow noreferrer"><code>ClusterRoleBinding</code></a> with a <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#subject-v1beta1-rbac-authorization-k8s-io" rel="nofollow noreferrer"><code>subjects:</code></a> of <code>type: User</code> with a <code>name:</code> of <code>client</code>.</p>

<p>The fix is to create a <code>ClusterRoleBinding</code> or <code>RoleBinding</code> -- depending on whether you want <code>client</code> to have access to <strong>every</strong> <code>Namespace</code> or just <code>default</code> -- and point it at an existing (or created) <code>Role</code> or <code>ClusterRole</code>. The bad news is that since your current credential is invalid, you will need to track down the <code>cluster-admin</code> credential to be able to make that kind of change. Since I haven't used GKE, I can't specify the exact steps.</p>

<p>I know those paragraphs are filled with jargon, and for that I'm sorry - it's a complex topic. There are several RBAC summaries, including a <a href="https://about.gitlab.com/2018/08/07/understanding-kubernestes-rbac/" rel="nofollow noreferrer">recent one from GitLab</a>, a <a href="https://www.youtube.com/watch?v=CnHTCTP8d48" rel="nofollow noreferrer">CNCF webinar</a>, and <a href="https://sysdig.com/blog/kubernetes-security-rbac-tls/" rel="nofollow noreferrer">one from Sysdig</a>, and (of course) <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">the kubernetes docs</a></p>
