K
Q

GKE traefik fails to create rbac permissions

9/1/2018

I am trying to install traefik as an ingress controller on GKE (google cloud kubernetes engine) and when I try:

kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml

I have this error:

Error from server (Forbidden): error when creating "https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml": clusterroles.rbac.authorization.k8s.io "traefik-ingress-controller" is forbidden: attempt to grant extra privileges: [PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["get"]} PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["list"]} PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["watch"]} PolicyRule{APIGroups:[""], Resources:["endpoints"], Verbs:["get"]} PolicyRule{APIGroups:[""], Resources:["endpoints"], Verbs:["list"]} PolicyRule{APIGroups:[""], Resources:["endpoints"], Verbs:["watch"]} PolicyRule{APIGroups:[""], Resources:["secrets"], Verbs:["get"]} PolicyRule{APIGroups:[""], Resources:["secrets"], Verbs:["list"]} PolicyRule{APIGroups:[""], Resources:["secrets"], Verbs:["watch"]} PolicyRule{APIGroups:["extensions"], Resources:["ingresses"], Verbs:["get"]} PolicyRule{APIGroups:["extensions"], Resources:["ingresses"], Verbs:["list"]} PolicyRule{APIGroups:["extensions"], Resources:["ingresses"], Verbs:["watch"]}] user=&{IzoPi4a@gmail.com [system:authenticated] map[user-assertion.cloud.google.com:[ADKE0IBz9kwSuZRZkfbLil8iC/ijcmJJmuys2DvDGxoxQ5yP6Pdq1IQs3JRwDmd/lWm2vGdMXGB4h1QKiwx+3uV2ciTb/oQNtkthBvONnVp4fJGOSW1S+8O8dqvoUNRLNeB5gADNn1TKEYoB+JvRkjrkTOxtIh7rPugLaP5Hp7thWft9xwZqF9U4fgYHnPjCdRgvMrDvGIK8z7ONljYuStpWdJDu7LrPpT0L]]} ownerrules=[PolicyRule{APIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/" "/apis" "/apis/" "/healthz" "/openapi" "/openapi/" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/" "/version" "/version/"], Verbs:["get"]}] ruleResolutionErrors=[]

The problem is this part only, the other one is created successfully:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch

Based on docs ( https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control) I tried executing this command but I still get the same error

kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user=MY_EMAIL_THAT_I_LOGIN_INTO_GCP

Has anyone ever manage to fix this? or it just does not work ?

I am trying to make a kubernetes cluster without loadBalancer in order to be cheap on my local machine (minikube), I have no such problems.

-- Izopi4a
google-cloud-platform
google-kubernetes-engine
kubernetes
traefik

Similar Questions

Kubernetes centralized logging using EFK
how could `secret` protect sensitive information in Kubernetes
unable to add helm addon to minishift on mac
How to disable swapping in Elasticsearch on Kubernetes?
AWS Boto3 No Credential Error IAM role K8S
Kubernetes: in-memory shared cache between pods
examples of files that etcd holds in kubernetes?
How to setup Kubernetes cluster on several windows hosts?
How to make API request to backend (flask) from frontend(react) running in kubernetes?

2 Answers

9/1/2018

So for everyone who is trying to install traefik on GKE, and you get stuck with that error message, just do that first https://stackoverflow.com/a/46316672/1747159

# Get password value
$ gcloud container clusters describe CUSTER_NAME --zone ZONE_NAME | grep password

# Pass username and password parameters
$ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml --username=admin --password=PASSWORD

Thanks Nicola Ben for helping me figure it out

-- Izopi4a
Source: StackOverflow
1/22/2019

The main problem here is that your current user has not enough rights to do this. To create the necessary binding:

kubectl create clusterrolebinding cluster-admin-binding \                                               
    --clusterrole=cluster-admin \
    --user=$(gcloud config get-value core/account)

Thanks to istio for the idea.

-- Max
Source: StackOverflow