kubectl command to GKE-Autopilot sometimes return forbidden error

Question

env

• GKE Autopilot v1.22.12-gke.2300
• use kubectl command from ubuntu2004 VM
• use gke-gcloud-auth-plugin

what happens

kubectl command sometimes return (Forbidden) error. e.g.)

kubectl get pod

Error from server (Forbidden): pods is forbidden: User "[email protected]" cannot list resource "pods" in API group "" in the namespace "default": GKEAutopilot authz: the request was sent before policy enforcement is enabled

It happens not always, so it must not be IAM problem. (it happens about 40%).
Before, I thinks it was GKE Autopilot v1.21.xxxx, this error didn't happen; at least not such frequently.

I couldn't find any helpful info even if I searched "GKEAutopilot authz", or "the request was sent before policy enforcement is enabled"

I wish if someone who faced to same issue has any idea.

Thank you in advance

Answer 1

I asked google cloud support. They said it's bug on GKE master, and was fixed by them.

This problem doesn't happen anymore