External DNS in Kubernetes involving istio out of nowhere from version 1.11

12/5/2018

Since today in version 1.11 of externaldns installed via helm i got this problem. The k8s provider is rancher and it's fresh, without anything else on it. The config is as per documentation. Please help.

            time="2018-12-05T15:08:00Z" level=info msg="config: {Master: KubeConfig: Sources:[service ingress] Namespace: AnnotationFilter: FQDNTemplate: CombineFQDNAndAnnotation:false Compatibility: PublishInternal:false Provider:aws GoogleProject: DomainFilter:[] ZoneIDFilter:[] AWSZoneType:private AWSAssumeRole: AzureConfigFile:/etc/kubernetes/azure.json AzureResourceGroup: CloudflareProxied:false InfobloxGridHost: InfobloxWapiPort:443 InfobloxWapiUsername:admin InfobloxWapiPassword: InfobloxWapiVersion:2.3.1 InfobloxSSLVerify:true DynCustomerName: DynUsername: DynPassword: DynMinTTLSeconds:0 InMemoryZones:[] PDNSServer:http://localhost:8081 PDNSAPIKey: Policy:upsert-only Registry:txt TXTOwnerID:default TXTPrefix: Interval:1m0s Once:false DryRun:false LogFormat:text MetricsAddress::7979 LogLevel:info}"
            time="2018-12-05T15:08:00Z" level=info msg="Connected to cluster at https://10.43.0.1:443"
            time="2018-12-05T15:08:01Z" level=error msg="services is forbidden: User \"system:serviceaccount:external-dns:default\" cannot list services at the cluster scope"
            time="2018-12-05T15:09:01Z" level=error msg="services is forbidden: User \"system:serviceaccount:external-dns:default\" cannot list services at the cluster scope"
            time="2018-12-05T15:10:03Z" level=error msg="services is forbidden: User \"system:serviceaccount:external-dns:default\" cannot list services at the cluster scope"
            time="2018-12-05T15:11:03Z" level=error msg="services is forbidden: User \"system:serviceaccount:external-dns:default\" cannot list services at the cluster scope"
            time="2018-12-05T15:12:04Z" level=error msg="services is forbidden: User \"system:serviceaccount:external-dns:default\" cannot list services at the cluster scope"
-- qubsup
amazon-route53
kube-dns
kubernetes-ingress

1 Answer

12/28/2018

Just make this command in your cluster

kubectl create clusterrolebinding external-dns-admin --clusterrole=cluster-admin --group=system:serviceaccounts --namespace=external-dns
-- Ulips
Source: StackOverflow