<p>I'm doing some POC for security research, trying to access namespace secrets directly from a worker node. I have a cluster on GKE running Kubernetes 1.20</p>
<p>I'm running the following command from a worker (none-master) node:</p>
<pre class="lang-sh prettyprint-override"><code>curl -v $APISERVER/api/v1/namespaces/default/pods/ \
  --cacert /etc/srv/kubernetes/pki/ca-certificates.crt \
  --cert /var/lib/kubelet/pki/kubelet-client.crt \
  --key /var/lib/kubelet/pki/kubelet-client.key
</code></pre>
<p>And it works fine.</p>
<p>However, trying to get secrets fails:</p>
<pre class="lang-sh prettyprint-override"><code>curl -v $APISERVER/api/v1/namespaces/default/secrets/ \
  --cacert /etc/srv/kubernetes/pki/ca-certificates.crt \
  --cert /var/lib/kubelet/pki/kubelet-client.crt \
  --key /var/lib/kubelet/pki/kubelet-client.key
</code></pre>
<pre class="lang-json prettyprint-override"><code>{
&quot;kind&quot;: &quot;Status&quot;,
&quot;apiVersion&quot;: &quot;v1&quot;,
&quot;metadata&quot;: {
},
&quot;status&quot;: &quot;Failure&quot;,
&quot;message&quot;: &quot;secrets is forbidden: User \&quot;system:node:gke-XXX--YYY\&quot; cannot list resource \&quot;secrets\&quot; in API group \&quot;\&quot; in the namespace \&quot;pencil\&quot;: No Object name found&quot;,
&quot;reason&quot;: &quot;Forbidden&quot;,
&quot;details&quot;: {
  &quot;kind&quot;: &quot;secrets&quot;
},
&quot;code&quot;: 403
</code></pre>
<p>Looking at the documentation, I see that kubelet running on node should be able to access secrets: <a href="https://kubernetes.io/docs/reference/access-authn-authz/node/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/node/</a></p>
<p>And from my understanding, the authorization is backed by the <code>ClusterRole</code> <code>system:node</code>. Looking at it I do see it has the role to <code>get</code> secrets:</p>
<pre class="lang-sh prettyprint-override"><code>% kubectl get clusterrole system:node -o json
{
    &quot;apiVersion&quot;: &quot;rbac.authorization.k8s.io/v1&quot;,
    &quot;kind&quot;: &quot;ClusterRole&quot;,
...
        {
            &quot;apiGroups&quot;: [
                &quot;&quot;
            ],
            &quot;resources&quot;: [
                &quot;configmaps&quot;,
                &quot;secrets&quot;
            ],
            &quot;verbs&quot;: [
                &quot;get&quot;,
                &quot;list&quot;,
                &quot;watch&quot;
            ]
        },
...
    ]
}
</code></pre>
<p>And some more relevant documentation for communication between kubelet and kube-apiserver: <a href="https://kubernetes.io/docs/concepts/architecture/control-plane-node-communication/#node-to-control-plane" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/architecture/control-plane-node-communication/#node-to-control-plane</a></p>

Mugen
<ul>
<li>I think the certificates location you are giving is incorrect. I have tried the same on my plain kubernetes cluster with following certificates and it worked fine.</li>
</ul>
<pre><code>curl --cacert /etc/kubernetes/pki/ca.crt --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt --key /etc/kubernetes/pki/apiserver-kubelet-client.key $APISERVER/api/v1/namespaces/default/secrets
</code></pre>
