<p>What controls the permissions when you call</p>
<p><code>kubectl logs pod-name</code> ?</p>
<p>I've played around and tried calling the kubelet api from on of the controller nodes.</p>
<p><code>sudo curl -k --key /var/lib/kubernetes/cert-k8s-apiserver-key.pem --cert /var/lib/kubernetes/cert-k8s-apiserver.pem https://worker01:10250/pods</code></p>
<p>This fails with <code>Forbidden (user=apiserver, verb=get, resource=nodes, subresource=proxy)</code>.</p>
<p>I've tried the same call using the admin key and cert and it succeeds and return a healthy blob of JOSN.</p>
<p>I'm guessing this is why <code>kubectl logs pod-name</code> doesn't work.</p>
<p>A little more reading suggests that the CN of the certificate determines the user that is authenticated and authorized.</p>
<p>What controls whether a user is authorized to access the kubelet API?</p>
<p><em>Background</em></p>
<p>I'm setting up a K8s cluster using the following instructions <a href="https://www.tauceti.blog/posts/kubernetes-the-not-so-hard-way-with-ansible-the-basics/" rel="nofollow noreferrer">Kubernetes the not so hard way with Ansible</a></p>

Isaac
<h2>Short Answer</h2>
<p>The short answer is that you need to grant the user <code>apiserver</code> access to the resource <code>node</code> by creating a ClusterRole and ClusterRoleBinding.</p>
<h2>Longer Explanation</h2>
<p>Kubernetes has a bunch of resources. The relevant ones here are:</p>
<ul>
<li>Role</li>
<li>Node</li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">ClusterRole</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">ClusterRoleBinding</a></li>
</ul>
<p>Roles and ClusterRoles are similar, except ClusterRoles are not namespaced.</p>
<p>A ClsuterRole can be associated (bound) to a user with a ClusterRoleBinding object.</p>
<p>Kubelet provides some resources (maybe more)</p>
<ul>
<li><code>nodes/proxy</code></li>
<li><code>nodes/stats</code></li>
<li><code>nodes/log</code></li>
<li><code>nodes/spec</code></li>
<li><code>nodes/metrics</code></li>
</ul>
<p>To make this work, you need to create a ClusterRole that allow access to the resource and sub-resource on the Node.</p>
<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: &quot;true&quot;
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: system:kube-apiserver-to-kubelet
rules:
  - apiGroups:
      - &quot;&quot;
    resources:
      - nodes/proxy
      - nodes/stats
      - nodes/log
      - nodes/spec
      - nodes/metrics
    verbs:
      - &quot;*&quot;
EOF

</code></pre>
<p>Then you associate this ClusteRole with a user. In my case, the kube-apiserver is using a certificate with <code>CN=apiserver</code>.</p>
<pre><code>cat &lt;&lt;EOF | kubectl apply --kubeconfig admin.kubeconfig -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:kube-apiserver
  namespace: &quot;&quot;
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:kube-apiserver-to-kubelet
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: apiserver
EOF

</code></pre>
