Cannot deploy ClusterRoles on GKE 1.8.1 Cluster about contour HOT 13 CLOSED

@marcwuk https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#prerequisites_for_using_role-based_access_control

from contour.

Further reading seems I run into this issue.
https://honeycomb.io/docs/connect/kubernetes/gke/

It would also seem this is going to be the norm soon, and users will need to bind to roles that allow the required priv escalation. https://kubernetes.io/docs/admin/authorization/rbac/#privilege-escalation-prevention-and-bootstrapping

Still unsure how to make this work "out-of-box" yet.

from contour.

Hi @erasmus74

The root of the problem is GKE does not enabled RBAC if you choose the Legacy Authentication option -- which is the default when you create a GKE cluster.

The solution is to use the non GKE example

kubectl apply -f http://j.hept.io/contour-deployment-norbac

I'm going to close this, but please reopen it if you need further assistance.

Thanks

Dave

from contour.

from contour.

Thanks for your reply. Looking at the response you posted that matches the error I see when I try to deploy the rbac example to a non rbac enbabled cluster.

If you use the non rbac version

kubectl apply -f http://j.hept.io/contour-deployment-norbac

You'll be fine.

from contour.

I'm seeing the same behavior with a GKE cluster running 1.9.2-gke.0. RBAC is enabled.

+ kubectl apply -f https://j.hept.io/contour-deployment-rbac
namespace "heptio-contour" created
serviceaccount "contour" created
deployment "contour" created
clusterrolebinding "contour" created
service "contour" created

Error from server (Forbidden): error when creating "https://j.hept.io/contour-deployment-rbac": clusterroles.rbac.authorization.k8s.io "contour" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["configmaps"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["configmaps"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["get"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["list"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["watch"]}] user=&{[email protected] [system:authenticated] map[]} ownerrules=[PolicyRule{Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], APIGroups:["authorization.k8s.io"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]}] ruleResolutionErrors=[]

Also, I was able to install cert-manager with rbac enabled.

I have installed helm as follows:

kubectl create serviceaccount -n kube-system tiller
kubectl create clusterrolebinding tiller-binding --clusterrole=cluster-admin --serviceaccount kube-system:tiller
helm init --service-account tiller

from contour.

I've found my mistake. Contour isn't using helm. The default RBAC for users in GKE is insufficiently privileged to deploy this. I've resolved this by creating a role binding to 'cluster-admin' for my user.

from contour.

from contour.

What is the magic incantation for GKE. Can we add this to the install guide.

from contour.

I had the same problem on GKE 1.8.8 with RBAC enabled. This helped me: kubernetes-sigs/external-dns#514

from contour.

from contour.

What's the downside of not using RBAC?

from contour.

from contour.