I have a problem with Kubernetes depoyment. Can anybody help I always get this error when trying to connect to the cluster IP

1/18/2019

I have problems with Kubernetes. I try to deploy my service for two days now bu I'm doing something wrong.

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\": No policy matched.",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}

Does anybody knows what the problem could be? Here is also my yaml file:

# Certificate
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
 name: ${APP_NAME}
spec:
 secretName: ${APP_NAME}-cert
 dnsNames:
   - ${URL}
   - www.${URL}
 acme:
   config:
     - domains:
         - ${URL}
         - www.${URL}
       http01:
         ingressClass: nginx
 issuerRef:
   name: ${CERT_ISSUER}
   kind: ClusterIssuer

---
# Ingress
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ${APP_NAME}
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/from-to-www-redirect: 'true'
spec:
  tls:
  - secretName: ${APP_NAME}-cert
    hosts:
    - ${URL}
    - www.${URL}
  rules:
  - host: ${URL}
    http:
      paths:
      - backend:
          serviceName: ${APP_NAME}-service
          servicePort: 80

---
# Service
apiVersion: v1
kind: Service
metadata:
  name: ${APP_NAME}-service
  labels:
    app: ${CI_PROJECT_NAME}
spec:
  selector:
    name: ${APP_NAME}
    app: ${CI_PROJECT_NAME}
  ports:
    - name: http
      port: 80
      targetPort: http

---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${APP_NAME}
  labels:
    app: ${CI_PROJECT_NAME}
spec:
  replicas: ${REPLICAS}
  revisionHistoryLimit: 0
  selector:
    matchLabels:
      app: ${CI_PROJECT_NAME}
  template:
    metadata:
      labels:
        name: ${APP_NAME}
        app: ${CI_PROJECT_NAME}
    spec:
      containers:
        - name: webapp
          image: eu.gcr.io/my-site/my-site.com:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 80
          env:
            - name: COMMIT_SHA
              value: ${CI_COMMIT_SHA}
          livenessProbe:
            tcpSocket:
              port: 80
            initialDelaySeconds: 30
            timeoutSeconds: 1
          readinessProbe:
            tcpSocket:
              port: 80
            initialDelaySeconds: 5
            timeoutSeconds: 1
          resources:
            requests:
              memory: '16Mi'
            limits:
              memory: '64Mi'
      imagePullSecrets:
        - name: ${REGISTRY_PULL_SECRET}

Can anybody help me with this? I'm stuck and I've no idea what could be the problem. This is also my first Kubernetes project.

-- user9468014
authentication
kubernetes
nginx

2 Answers

1/19/2019

"message": "forbidden: User \"system:anonymous\" cannot get path \"/\": No policy matched.",

.. means just what it says: your request to the kubernetes api was not authenticated (that's the system:anonymous part), and your RBAC configuration does not tolerate the anonymous user making any requests to the API

No one here is going to be able to help you straighten out that problem, because fixing that depends on a horrific number of variables. Perhaps ask your cluster administrator to provide you with the correct credentials.

-- mdaniel
Source: StackOverflow

1/21/2019

I have explained it in this post. You will need ServiceAccount, ClusterRole and RoleBinding. You can find explanation in this article. Or as Matthew L Daniel mentioned in the Kubernetes documentation. If you still have problems, provide the method/tutorial you have used to deploy the cluster (as "Gitlab Kubernetes integration" does not tell much on the method you have used).

-- aurelius
Source: StackOverflow