问题：

[root@k8s-master yaml_all]# kubectl get po
NAME                     READY   STATUS    RESTARTS   AGE
nginx-648b5cc477-7b5pt   1/1     Running   0          3h41m
nginx-648b5cc477-mplmg   1/1     Running   0          3h41m
nginx-648b5cc477-zw8jq   1/1     Running   0          3h41m

执行下面这条后报错了

[root@k8s-master yaml_all]# kubectl exec -it nginx-648b5cc477-7b5pt bash
error: unable to upgrade connection: Forbidden (user=system:anonymous, verb=create, resource=nodes, subresource=proxy)

临时解决方法：
绑定一个cluster-admin的权限

[root@k8s-master yaml_all]# kubectl create clusterrolebinding system:anonymous --clusterrole=cluster-admin --user=system:anonymous
clusterrolebinding.rbac.authorization.k8s.io/system:anonymous created

[root@k8s-master yaml_all]# kubectl exec -it nginx-648b5cc477-7b5pt -- bash 
root@nginx-648b5cc477-7b5pt:/# ls
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
root@nginx-648b5cc477-7b5pt:/# exit
exit