From d62f7af933dc9476484f325ab0c0bab5efa80316 Mon Sep 17 00:00:00 2001
From: teerasits <84091312+teerasits@users.noreply.github.com>
Date: Thu, 13 May 2021 00:02:52 +0800
Subject: [PATCH] Update 13-kube-apiserver-to-kubelet.md

Hi,
I'm getting this error.

vagrant@master-1:~$ kubectl exec -ti busybox -- nslookup kubernetes

error: unable to upgrade connection: Forbidden (user=kube-apiserver, verb=create, resource=nodes, subresource=proxy)

vagrant@master-1:~$

It's due to this change in GitHub..
[Correction: User should be system:kube-apiserver] 13-kube-apiserver-to-kubelet.md #118


I've just reverted this change and then it's OK.

cat <<EOF | kubectl apply --kubeconfig admin.kubeconfig -f -
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: system:kube-apiserver
  namespace: ""
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:kube-apiserver-to-kubelet
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: kube-apiserver  # system:kube-apiserver
EOF
---
 docs/13-kube-apiserver-to-kubelet.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/13-kube-apiserver-to-kubelet.md b/docs/13-kube-apiserver-to-kubelet.md
index 1f2ec9a..a8d05b9 100644
--- a/docs/13-kube-apiserver-to-kubelet.md
+++ b/docs/13-kube-apiserver-to-kubelet.md
@@ -50,7 +50,7 @@ roleRef:
 subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: User
-    name: system:kube-apiserver
+    name: kube-apiserver
 EOF
 ```
 Reference: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding