kubernetes: Error from server (Forbidden): User "system:anonymous" cannot list nodes at the cluster scope even after granting permission

user_6380294 0
Viewed 18932

Even after granting cluster roles to user, I get Error from server (Forbidden): User "system:anonymous" cannot list nodes at the cluster scope. (get nodes)

I have the following set for the user:

- context:
    cluster: kubernetes
    user: user@gmail.com
  name: user@kubernetes`  set in the ~/.kube/config file

and the below added to admin.yaml to create cluster-role and cluster-rolebindings:

kind: CluserRouster: kubernetes    user: nsp@gmail.com  name: nsp@kubernetese
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin-role
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
---
oidckind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin-binding
subjects:
  - kind: User
    name: nsp@gmail.com
roleRef:
  kind: ClusterRole
  name: admin-role

When I try the command I still get error.

kubectl --username=user@gmail.com get nodes
Error from server (Forbidden): User "system:anonymous" cannot list nodes at the cluster scope. (get nodes)

Can someone please suggest on how to proceed.

kubeadm kubernetes openid-connect
2 Answers

In my case i was receiving nearly similar error due to RBAC

Error

root@k8master:~# kubectl cluster-info dump --insecure-skip-tls-verify=true
Error from server (Forbidden): nodes is forbidden: User "system:anonymous" cannot list resource "nodes" in API group "" at the cluster scope

Solution: As Solution i have done below things to reconfigure my user to access cluster

cd $HOME
sudo whoami
sudo cp /etc/kubernetes/admin.conf $HOME/
sudo chown $(id -u):$(id -g) $HOME/admin.conf
export KUBECONFIG=$HOME/admin.conf
echo "export KUBECONFIG=$HOME/admin.conf" | tee -a ~/.bashrc

After doing above when i take cluster dump i got result

root@k8master:~# kubectl cluster-info
Kubernetes master is running at https://192.168.10.15:6443
KubeDNS is running at https://192.168.10.15:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
user_45723960
Related