GKE clusterrolebinding for cluster-admin fails wit

Question

I've just created a new cluster using Google Container Engine running Kubernetes 1.7.5, with the new RBAC permissions enabled. I've run into a problem allocating permissions for some of my services which lead me to the following:

The docs for using container engine with RBAC state that the user must be granted the ability to create authorization roles by running the following command:

kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin [--user=<user-name>]

However, this fails due to lack of permissions (which I would assume are the very same permissions which we are attempting to grant by running the above command).

Error from server (Forbidden): 
User "<user-name>" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope.: 
  "Required \"container.clusterRoleBindings.create\" permission." 
  (post clusterrolebindings.rbac.authorization.k8s.io)

Any help would be much appreciated as this is blocking me from creating the permissions needed by my cluster services.

Answer 1

If your kubeconfig was created automatically by gcloud then your user is not the all powerful admin user - which you are trying to create a binding for.

Use gcloud container clusters describe <clustername> --zone <zone> on the cluster and look for the password field.

Thereafter execute kubectl --username=admin --password=FROMABOVE create clusterrolebinding ...

Answer 2

Janos's answer will work for GKE clusters that have been created with a password, but I'd recommend avoiding using that password wherever possible (or creating your GKE clusters without a password).

Using IAM: To create that ClusterRoleBinding, the caller must have the container.clusterRoleBindings.create permission. Only the OWNER and Kubernetes Engine Admin IAM Roles contain that permission (because it allows modification of access control on your GKE clusters).

So, to allow [e-mail] to run that command, they must be granted one of those roles. E.g.:

gcloud projects add-iam-policy-binding $PROJECT \
  --member=user:[e-mail] \
  --role=roles/container.admin