What happened:

I'm testing kubernetes 1.9.0 to upgrade production cluster and I cannot access it with kubectl from other host.

I'm getting following error:

pods is forbidden: User \"system:anonymous\" cannot list pods in the namespace \"default\"

I tried with admin user and with other user created before with read only role.

What you expected to happen:

Works fine on kubernetes 1.5

How to reproduce it (as minimally and precisely as possible):

I installed kubernetes 1.9.0 with kubeadm.

I can access to local cluster from master with following command: kubectl --kubeconfig kubeconfig get pods

with server: https://127.0.0.1:6443

I added a rule on haproxy to redirect that port to another, but I do some tests:

• Old environment have a proxy configured to all requests asking for https://example.org/api/k8s will be redirect to k8s api endpoint.

• I configured this new environment with same configuration but not working. (Error: pods is forbidden: User \"system:anonymous\" cannot list pods in the namespace \"default\" )

• I configured this new enviroment with a new DNS name and proxying on tcp mode linking port 443 to 6443, but not working. (Error: pods is forbidden: User \"system:anonymous\" cannot list pods in the namespace \"default\" )

kubeconfig file set server field as: https://k8s.example.org

Anything else we need to know?:

kubeconfig file (kubeconfig for admin user is similar):

` api

Version: v1
clusters:
- cluster:
    certificate-authority-data: ***
    server: https://127.0.0.1:6443
    #server: https://k.example.org
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: default
    user: read_only
  name: read_only-context
current-context: read_only-context
kind: Config
preferences: {}
users:
- name: read_only
  user:
    as-user-extra: {}
    client-certificate: /etc/kubernetes/users/read_only/read_only.crt
    client-key: /etc/kubernetes/users/read_only/read_only.key
    user

name: read_only `

Environment:

• Kubernetes version (use kubectl version): 1.9.0
• Cloud provider or hardware configuration: bare metal (in fact a VM on AWS)
• OS (e.g. from /etc/os-release): Centos 7
• Kernel (e.g. uname -a): 3.10.0-514.10.2.el7.x86_64
• Install tools: kubeadm
• Others: