Cannot create clusterrolebinding on fresh GKE cluster

Question

I provisioned a managed GKE cluster (Kubernetes version 1.9.4-gke.1) with basic authentication disabled. When i try to create RBAC configuration (for running my ingress controller) I get a following error: Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "XXX@gmail.com" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.

I found two related questions:

1. GKE clusterrolebinding for cluster-admin fails with permission error
2. User "xxx" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope

First one contains a solution when basic authentication is enabled for the cluster which is not my case. And second question does not have an answer.

My user is not owner of the GCP project but it has editor role in the project. I found that this behavior was observed by others.

Please, advise how can I add the missing permission or otherwise defined RBAC on the GKE cluster when the cluster has basic authentication disabled.

Answer 1

To create that ClusterRoleBinding, the caller must have container.clusterRoleBindings.create permission through GCP IAM. Only the OWNER and Kubernetes Admin IAM Roles contain that permission (because it allows modification of access control on your GKE clusters).

So, to allow person@company.com to run that command, they must be granted one of those roles. I'd recommend the Kubernetes Admin role.:

gcloud projects add-iam-policy-binding $PROJECT --member=user:person@company.com --role=roles/container.admin