3

I am trying to install traefik as an ingress controller on GKE (google cloud kubernetes engine) and when I try:

kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml

I have this error:

Error from server (Forbidden): error when creating "https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml": clusterroles.rbac.authorization.k8s.io "traefik-ingress-controller" is forbidden: attempt to grant extra privileges: [PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["get"]} PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["list"]} PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["watch"]} PolicyRule{APIGroups:[""], Resources:["endpoints"], Verbs:["get"]} PolicyRule{APIGroups:[""], Resources:["endpoints"], Verbs:["list"]} PolicyRule{APIGroups:[""], Resources:["endpoints"], Verbs:["watch"]} PolicyRule{APIGroups:[""], Resources:["secrets"], Verbs:["get"]} PolicyRule{APIGroups:[""], Resources:["secrets"], Verbs:["list"]} PolicyRule{APIGroups:[""], Resources:["secrets"], Verbs:["watch"]} PolicyRule{APIGroups:["extensions"], Resources:["ingresses"], Verbs:["get"]} PolicyRule{APIGroups:["extensions"], Resources:["ingresses"], Verbs:["list"]} PolicyRule{APIGroups:["extensions"], Resources:["ingresses"], Verbs:["watch"]}] user=&{[email protected] [system:authenticated] map[user-assertion.cloud.google.com:[ADKE0IBz9kwSuZRZkfbLil8iC/ijcmJJmuys2DvDGxoxQ5yP6Pdq1IQs3JRwDmd/lWm2vGdMXGB4h1QKiwx+3uV2ciTb/oQNtkthBvONnVp4fJGOSW1S+8O8dqvoUNRLNeB5gADNn1TKEYoB+JvRkjrkTOxtIh7rPugLaP5Hp7thWft9xwZqF9U4fgYHnPjCdRgvMrDvGIK8z7ONljYuStpWdJDu7LrPpT0L]]} ownerrules=[PolicyRule{APIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/" "/apis" "/apis/" "/healthz" "/openapi" "/openapi/" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/" "/version" "/version/"], Verbs:["get"]}] ruleResolutionErrors=[]

The problem is this part only, the other one is created successfully:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch

Based on docs ( https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control) I tried executing this command but I still get the same error

kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user=MY_EMAIL_THAT_I_LOGIN_INTO_GCP

Has anyone ever manage to fix this? or it just does not work ?

I am trying to make a kubernetes cluster without loadBalancer in order to be cheap on my local machine (minikube), I have no such problems.

6
  • It sounds a problem related to your user. Not enough permissions to handle clusterrolebindings resources..
    – Nicola Ben
    Sep 1, 2018 at 15:07
  • i am the only user. Its my personal account. Perhaps i need to "enable" something to my user ? but i have no idea what
    – Izopi4a
    Sep 1, 2018 at 15:09
  • 2
    Read this: stackoverflow.com/questions/46307325/…
    – Nicola Ben
    Sep 1, 2018 at 15:11
  • omg this seems to be doing the trick... man that is really complicated. I will need ~ 1 hour to finish my tests and close this question ( somehow ? )
    – Izopi4a
    Sep 1, 2018 at 15:37
  • @NicolaBen can you post answer so i can accept it as an answer to the thread
    – Izopi4a
    Sep 1, 2018 at 15:50

2 Answers 2

8

So for everyone who is trying to install traefik on GKE, and you get stuck with that error message, just do that first https://stackoverflow.com/a/46316672/1747159

# Get password value
$ gcloud container clusters describe CUSTER_NAME --zone ZONE_NAME | grep password

# Pass username and password parameters
$ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml --username=admin --password=PASSWORD

Thanks Nicola Ben for helping me figure it out

2

The main problem here is that your current user has not enough rights to do this. To create the necessary binding:

kubectl create clusterrolebinding cluster-admin-binding \                                               
    --clusterrole=cluster-admin \
    --user=$(gcloud config get-value core/account)

Thanks to istio for the idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.