Istio installation on GKE failed with "clusterroles.rbac.authorization.k8s.io "istio-pilot" is forbidden: attempt to grant extra privileges"

Question

Trying to install istio 0.1.6 on GKE (Google Container Engine).

Running follow to check if cluster has RBAC (Role-Based Access Control) enabled:

$ kubectl api-versions | grep rbac
rbac.authorization.k8s.io/v1beta1

It displays ‘beta’ version, so I run:

$ kubectl apply -f istio-0.1.6/install/kubernetes/istio-rbac-beta.yaml
Error from server (Forbidden): error when creating "istio-0.1.6/install/kubernetes/istio-rbac-beta.yaml": clusterroles.rbac.authorization.k8s.io "istio-pilot" is forbidden: attempt to grant extra privileges:...

Cluster role binding creation didn't help:

$ kubectl create clusterrolebinding myname-cluster-admin-binding --clusterrole=cluster-admin --user=myname@example.org

Any idea how to fix this?

More details:

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.2", GitCommit:"477efc3cbe6a7effca06bd1452fa356e2201e1ee", GitTreeState:"clean", BuildDate:"2017-04-19T20:33:11Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.4", GitCommit:"d6f433224538d4f9ca2f7ae19b252e6fcb66a3ae", GitTreeState:"clean", BuildDate:"2017-05-19T18:33:17Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"}

Answer 1

I have run into this. For me the solution was that the email address argument to --user had to be lower case. That means --user=foo.bar@example.com and not --user=Foo.Bar@example.com

Answer 2

CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True gcloud container clusters get-credentials...

Adding CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True to gcloud container clusters get-credentials command, which updates a kubeconfig file with appropriate credentials to point kubectl at a Container Engine Cluster, solved the problem :)

Reference: istio issue