GKE集群连接升级授权错误问题求助

Hey there, let’s work through this authorization error you’re facing in your GKE cluster. That error message unable to upgrade connection:Authorization error (user=kube-apiserver, verb=create, resource=nodes, sub resource=proxy) typically crops up when the kube-apiserver lacks the necessary permissions to create a node proxy resource—this is critical for operations like running kubectl exec or accessing pod logs.

Here are some practical steps to troubleshoot and fix this:

• Verify ClusterRoleBindings for the kube-apiserver
  First, check if the kube-apiserver’s service account is properly bound to a ClusterRole that includes the create permission for nodes/proxy. Run this command to list relevant bindings:

  kubectl get clusterrolebindings | grep -i apiserver
  

  Look for bindings linked to the system:kube-apiserver ClusterRole—this role should include the required permissions by default. If you don’t see a valid binding, you may need to re-create it.

• Inspect the default system:kube-apiserver ClusterRole
  GKE’s default RBAC rules usually include the necessary nodes/proxy permissions, but custom changes or cluster updates can sometimes break this. Check the role’s permissions with:

  kubectl describe clusterrole system:kube-apiserver
  

  Scan the output for an entry like Resources: nodes/proxy with Verbs: create. If this is missing, you can edit the ClusterRole to add it (note: some default GKE roles are protected, so proceed carefully). Alternatively, check if any custom ClusterRoleBindings are overriding the default permissions.

• Check the system:kube-apiserver-to-kubelet binding
  This ClusterRoleBinding is responsible for granting the kube-apiserver access to kubelet resources, including nodes/proxy. Verify it exists with:

  kubectl get clusterrolebinding system:kube-apiserver-to-kubelet
  

  If it’s missing or misconfigured, recreate it using the default GKE settings—this is a common fix for this type of authorization error.

• Refresh cluster control plane permissions
  Sometimes a control plane refresh can resolve permission inconsistencies. You can trigger this by upgrading your cluster’s master version (even if you’re staying on the same version, the refresh process will reset default permissions):

  gcloud container clusters update YOUR_CLUSTER_NAME --zone YOUR_CLUSTER_ZONE --master-version CURRENT_VERSION
  

  Replace YOUR_CLUSTER_NAME, YOUR_CLUSTER_ZONE, and CURRENT_VERSION with your cluster’s details.

If none of these steps resolve the issue, sharing more context would help—like whether you’ve recently modified RBAC configurations, upgraded the cluster, or added any custom security policies (like PodSecurityPolicies).

备注：内容来源于stack exchange，提问作者Martin rudez