Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing role permissions needed in example manifest #92

Open
cmagorian opened this issue Sep 9, 2020 · 4 comments · May be fixed by #117
Open

Missing role permissions needed in example manifest #92

cmagorian opened this issue Sep 9, 2020 · 4 comments · May be fixed by #117

Comments

@cmagorian
Copy link

From deploying the example manifest (not helm), I needed to add the following block in the ClusterRole:

- apiGroups: ['']
  resources: [endpoints]
  verbs: [get, patch, update]

To remove this error message:

leaderelection.go:324] error retrieving resource lock kube-system/draino: endpoints "draino" is forbidden: User "system:serviceaccount:kube-system:draino" cannot get resource "endpoints" in API group "" in the namespace "kube-system"

Would you guys be open to a PR for this?
@tomaaron
Copy link

I'm having nearly the same issue:

E1015 08:57:38.037739       1 leaderelection.go:328] error initially creating leader election record: endpoints is forbidden: User "system:serviceaccount:kube-system:draino" cannot create resource "endpoints" in API group "" in the namespace "kube-system"

I guess there is also create missing. Take a look at the helm chart. I would suggest to create the manifest from the helm chart and sync it via github actions or similar.

@jacobstr
Copy link
Contributor

Yep! Open to an MR!

@matharoo
Copy link

matharoo commented Feb 3, 2021

I was getting a similar error too but with creation :

error initially creating leader election record: endpoints is forbidden: User "system:serviceaccount:kube-system:draino" cannot create resource "endpoints" in API group "" in the namespace "kube-system"

So I also added create under endpoints:

- apiGroups: ['']
  resources: [endpoints]
  verbs: [get, create, patch, update]

@tarunptala
Copy link

yes i experienced the same. Solved it by adding that extra rbac permissions. Btw its correctly mentioned in given helm chart, but yes it should be updated in the manifest.yml as well. @cmagorian

bilalcaliskan added a commit to bilalcaliskan/draino that referenced this issue May 14, 2021
@bilalcaliskan
fixes planetlabs#92: rbac modifications for permission issues
a98a4b8
@bilalcaliskan bilalcaliskan linked a pull request May 14, 2021 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

rbac modifications for permission issues bilalcaliskan/draino
5 participants
@jacobstr @tomaaron @matharoo @cmagorian @tarunptala