RBAC settings for Ingress

gcyre · March 11, 2018, 11:34pm

Hello all

I’m going through the example for setting up the Linkerd as an ingress controller and have run into an issue with RBAC permissions

https://buoyant.io/2017/04/06/a-service-mesh-for-kubernetes-part-viii-linkerd-as-an-ingress-controller/

I’ve applied the RBAC settings from

github.com

linkerd/linkerd-examples/blob/master/k8s-daemonset/k8s/linkerd-rbac-beta.yml

# RBAC configs for linkerd
---
# grant linkerd/namerd permissions to enable service discovery
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-endpoints-reader
rules:
  - apiGroups: [""] # "" indicates the core API group
    resources: ["endpoints", "services", "pods"] # pod access is required for the *-legacy.yml examples in this folder
    verbs: ["get", "watch", "list"]
---
# grant namerd permissions to custom resource definitions in k8s 1.8+ and third party resources in k8s < 1.8 for dtab storage
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: namerd-dtab-storage
rules:
  - apiGroups: ["l5d.io"]
    resources: ["dtabs"]

This file has been truncated. show original

but I’m seeing these errors when trying to hit the endpoint

E 0311 23:09:28.757 UTC THREAD30: retrying k8s request to /apis/extensions/v1beta1/ingresses on unexpected response code 403 with message {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"ingresses.extensions is forbidden: User \"system:serviceaccount:l5d-system:default\" cannot list ingresses.extensions at the cluster scope","reason":"Forbidden","details":{"group":"extensions","kind":"ingresses"},"code":403}

not sure what permissions are needed to allow access

marzipan · March 12, 2018, 6:10pm

Hi @gcyre! Can you try applying the ingress permissions from
https://github.com/linkerd/linkerd-examples/pull/208?
We’ll get that branch merged soon.

gcyre · March 12, 2018, 8:06pm

thanks @marzipan, this solved the problem

system · April 11, 2018, 8:06pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.