title: Kubernetes RBAC unable to upgrade connection: Forbidden (user=system:anonymous, verb=create, resource=nodes, subresource=proxy)
body: <p>I'm running Kubernetes 1.6.2 with RBAC enabled. I've created a user <code>kube-admin</code> that has the following Cluster Role binding</p>
  <pre class="lang-yaml prettyprint-override"><code>kind: ClusterRoleBinding
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    name: k8s-admin
  subjects:
  - kind: User
    name: kube-admin
    apiGroup: rbac.authorization.k8s.io
  roleRef:
    kind: ClusterRole
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io
  </code></pre>
  <p>When I attempt to <code>kubectl exec</code> into a running pod I get the following error.</p>
  <pre class="lang-sh prettyprint-override"><code>kubectl -n kube-system exec -it kubernetes-dashboard-2396447444-1t9jk -- /bin/bash
  error: unable to upgrade connection: Forbidden (user=system:anonymous, verb=create, resource=nodes, subresource=proxy)
  </code></pre>
  <p>My guess is I'm missing a <code>ClusterRoleBinding</code> ref, which role am I missing?</p>