K
Q

kubectl apply yield forbidden, error when retrieving current configuration

6/21/2018

followed steps to create single master cluster, i was able to successfully init the master, but when apply i got forbidden error, any one experienced the same? thanks!

i did the following

1. disable selinux in /etc/selinux/config, and reboot
2. comment out KUBELET_NETWORK_ARGS in 
         /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
3. export no_proxy=$no_proxy,<master-ip> 
4. export KUBECONFIG=/etc/kubernetes/kubelet.conf in .bash_profile

after init success, when try to apply

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml

i got below error messages

Error from server (Forbidden): error when retrieving current configuration of:
&{0xc42048ab40 0xc421a83730  
flannel https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml 0xc42109cc20  false}
from server for: "https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml": 
clusterroles.rbac.authorization.k8s.io "flannel" is forbidden: 
User "system:node:<master-server-name>" 
cannot get clusterroles.rbac.authorization.k8s.io at the cluster scope
-- Antelope
kubernetes

Similar Questions

Shared PersistenceVolumeClaim(PVC) across namespaces
Kubernetes storing persistent files
Volumes between deployment replicas
fluentd tag rewrite on kubernetes logs only works when appending original tag
Kubernetes autoscaling : HPA not working with custom metrics for Java Netty API

3 Answers

6/21/2018

you somehow switched from using the cluster-admin kubeconfig (which has superuser access) to using the master node kubeconfig (which only has access to things a kubelet/node should be able to do)

-- Jordan Liggitt
Source: StackOverflow
6/21/2018

As soon as your cluster is not yet fully functional, it would be easier to tear it down and recreate from scratch:

Tear down everything:

$> sudo su
#> kubeadm reset
#> rm -rf $HOME/.kube /etc/kubernetes

Prepare your host (just in case you haven’t done it already):

#> swapoff -a
## Don't forget to comment swap partition line in /etc/fstab

## I assume that you have these packages already installed: docker, kubeadm, kubectl

## tune sysctl to pass bridged IPv4 traffic to iptables’ chains. 
## This is a requirement for some CNI plugins to work, for more information please see
## https://kubernetes.io/docs/concepts/cluster-administration/network-plugins/#network-plugin-requirements

#> cat <<EOF >>/etc/ufw/sysctl.conf
net/bridge/bridge-nf-call-ip6tables = 1
net/bridge/bridge-nf-call-iptables = 1
net/bridge/bridge-nf-call-arptables = 1
EOF
#> sudo sysctl --system

Initialize the cluster:

## Do not try to set less than /16 subnet for `--pod-network-cidr`

#> kubeadm init --pod-network-cidr=10.244.0.0/16

## Prepare the kubectl config

#> mkdir -p $HOME/.kube
#> cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
#> chown $(id -u):$(id -g) $HOME/.kube/config

Install Flannel

#> kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v0.10.0/Documentation/kube-flannel.yml

Allow pod scheduled on the master node.

(Just in case you do not have any worker nodes.)

#> kubectl taint nodes --all node-role.kubernetes.io/master-

At this point you should have ready-to-use Kubernetes cluster:

#> kubectl get nodes
#> kubectl get pods --all-namespaces
-- VAS
Source: StackOverflow
10/22/2019
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

instead of

cp -i /etc/kubernetes/kubelet.conf ~/.kube/config
-- ktl
Source: StackOverflow