{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/federation/issues/110","repository_url":"https://api.github.com/repos/kubernetes/federation","labels_url":"https://api.github.com/repos/kubernetes/federation/issues/110/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/federation/issues/110/comments","events_url":"https://api.github.com/repos/kubernetes/federation/issues/110/events","html_url":"https://github.com/kubernetes/federation/issues/110","id":269846594,"number":110,"title":"[Federation] kubefed init roles.rbac.authorization error","user":{"login":"irfanurrehman","id":10027921,"avatar_url":"https://avatars0.githubusercontent.com/u/10027921?v=4","gravatar_id":"","url":"https://api.github.com/users/irfanurrehman","html_url":"https://github.com/irfanurrehman","followers_url":"https://api.github.com/users/irfanurrehman/followers","following_url":"https://api.github.com/users/irfanurrehman/following{/other_user}","gists_url":"https://api.github.com/users/irfanurrehman/gists{/gist_id}","starred_url":"https://api.github.com/users/irfanurrehman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/irfanurrehman/subscriptions","organizations_url":"https://api.github.com/users/irfanurrehman/orgs","repos_url":"https://api.github.com/users/irfanurrehman/repos","events_url":"https://api.github.com/users/irfanurrehman/events{/privacy}","received_events_url":"https://api.github.com/users/irfanurrehman/received_events","type":"User","site_admin":false},"labels":[{"id":732626521,"url":"https://api.github.com/repos/kubernetes/federation/labels/area/federation","name":"area/federation","color":"ededed","default":false},{"id":732626523,"url":"https://api.github.com/repos/kubernetes/federation/labels/priority/important-longterm","name":"priority/important-longterm","color":"ededed","default":false},{"id":732626525,"url":"https://api.github.com/repos/kubernetes/federation/labels/sig/multicluster","name":"sig/multicluster","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-10-31T06:13:31Z","updated_at":"2017-10-31T06:13:44Z","closed_at":null,"author_association":"MEMBER","body":"<a href=\"https://github.com/mawentao02\"><img src=\"https://avatars2.githubusercontent.com/u/25891133?v=4\" align=\"left\" width=\"96\" height=\"96\" hspace=\"10\"></img></a> **Issue by [mawentao02](https://github.com/mawentao02)**\n_Monday Mar 06, 2017 at 07:52 GMT_\n_Originally opened as https://github.com/kubernetes/kubernetes/issues/42559_\n\n----\n\n<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.-->\r\n\r\n**Is this a request for help?** (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.):\r\n\r\n\r\n**What keywords did you search in Kubernetes issues before filing this one?** (If you have found any duplicates, you should instead reply there.):\r\n\r\n---\r\n\r\n**Is this a BUG REPORT or FEATURE REQUEST?** (choose one):\r\n\r\n<!--\r\nIf this is a BUG REPORT, please:\r\n  - Fill in as much of the template below as you can.  If you leave out\r\n    information, we can't help you as well.\r\n\r\nIf this is a FEATURE REQUEST, please:\r\n  - Describe *in detail* the feature/behavior/change you'd like to see.\r\n\r\nIn both cases, be ready for followup questions, and please respond in a timely\r\nmanner.  If we can't reproduce a bug or think a feature already exists, we\r\nmight close your issue.  If we're wrong, PLEASE feel free to reopen it and\r\nexplain why.\r\n-->\r\n\r\n**Kubernetes version** (use `kubectl version`):\r\nkubernetes-1.6.0-beta.1\r\n\r\n**Environment**:\r\n- **Cloud provider or hardware configuration**:hardware configuration\r\n- **OS** (e.g. from /etc/os-release): Ubuntu 14.04.1 LTS\r\n- **Kernel** (e.g. `uname -a`): 4.2.0-27-generic\r\n- **Install tools**: kubefed init\r\n- **Others**:\r\n\r\n\r\n**What happened**:\r\n### I use kubefed init to init federation in kubernetes-1.6.0-beta.1.\r\nkubefed init k8s-federation --host-cluster-context=cluster-cloud92  \\\r\n--api-server-service-type='NodePort'  --api-server-advertise-address='172.31.8.29' \\\r\n--dns-provider='coredns'  --dns-provider-config='/var/run/kubernetes/federation-codedns-config.conf'  --dns-zone-name='cluster-cloud92.com' \\\r\n--etcd-persistent-storage=false --kubeconfig='/var/run/kubernetes/kubeconfig'\r\n\r\n### It show this error:\r\n**Error from server (Forbidden): roles.rbac.authorization.k8s.io \"federation-system:federation-controller-manager\" is forbidden: attempt to grant extra privileges:** [{[get] [] [secrets] [] []} {[list] [] [secrets] [] []} {[watch] [] [secrets] [] []}] user=&{admin admin [system:authenticated] map[]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /swaggerapi\r\n\r\n### It created federation-apiserver successful, but failed create  federation-controller-manager.\r\nkubectl get pod --namespace=federation-system \r\nNAME READY STATUS RESTARTS AGE\r\nk8s-federation-apiserver-2603477136-7srv0 2/2 Running 0 1m\r\n \r\nkubectl get secret --namespace=federation-system \r\nNAME TYPE DATA AGE\r\ndefault-token-vwmcj kubernetes.io/service-account-token 2 2m\r\nfederation-controller-manager-token-vgsg8 kubernetes.io/service-account-token 2 2m\r\nk8s-federation-apiserver-credentials Opaque 3 2m\r\nk8s-federation-controller-manager-kubeconfig Opaque 1 2m\r\n\r\n### Here is my k8s cluster configuration:\r\n**cat /var/run/kubernetes/kubeconfig**\r\napiVersion: v1\r\nkind: Config\r\nclusters:\r\n- cluster:\r\ninsecure-skip-tls-verify: true\r\nserver: https://172.31.8.29:443\r\nname: cluster-cloud92\r\ncontexts:\r\n- context:\r\ncluster: cluster-cloud92 \r\nuser: cluster-cloud92 \r\nname: cluster-cloud92\r\ncurrent-context: cluster-cloud92\r\nusers:\r\n- name: cluster-cloud92\r\nuser:\r\ntoken: tSjgxDGkhDe8iweWU2fWC7a64clc7MR8\r\n\r\n**docker@bjkjy-ite-cloud92:~$ kubectl config view**\r\napiVersion: v1\r\nclusters:\r\n- cluster:\r\ninsecure-skip-tls-verify: true\r\nserver: https://172.31.8.29:443\r\nname: cluster-cloud92\r\ncontexts:\r\n- context:\r\ncluster: cluster-cloud92\r\nuser: cluster-cloud92\r\nname: cluster-cloud92\r\ncurrent-context: cluster-cloud92\r\nkind: Config\r\npreferences: {}\r\nusers:\r\n- name: cluster-cloud92\r\nuser:\r\ntoken: tSjgxDGkhDe8iweWU2fWC7a64clc7MR8\r\n\r\n**cat /var/run/kubernetes/federation-codedns-config.conf**\r\n[Global]\r\netcd-endpoints=http://172.31.8.29:2379\r\nzones=cluster-cloud92.com\r\n\r\n\r\n### I have enabled serviceaccount in kube-apiserver and specify --service_account_private_key_file in kibe-controller-manager.\r\nI didn't use ca, just use token for kube-apiserver.--secure-port=443 --token-auth-file=/etc/kubernetes/token_auth_file.\r\n\r\n\r\n**ps -ef | grep kube**\r\n /hyperkube federation-apiserver --admission-control=NamespaceLifecycle --advertise-address=172.31.8.29 --bind-address=0.0.0.0 --client-ca-file=/etc/federation/apiserver/ca.crt --etcd-servers=http://localhost:2379 --secure-port=443 --tls-cert-file=/etc/federation/apiserver/server.crt --tls-private-key-file=/etc/federation/apiserver/server.key\r\n\r\n\r\n/opt/bin/kube-apiserver --insecure-bind-address=0.0.0.0 --insecure-port=8080 **--secure-port=443 --token-auth-file=/etc/kubernetes/token_auth_file** --etcd-servers=http://172.31.8.29:2379 --logtostderr=true --service-cluster-ip-range=172.31.96.0/22 --admission-control=NamespaceLifecycle,LimitRanger,ResourceQuota,DenyEscalatingExec,SecurityContextDeny,**ServiceAccount** --service-node-port-range=30000-32767 --v=4\r\n\r\n/opt/bin/kube-controller-manager --master=127.0.0.1:8080 **--service_account_private_key_file=/var/run/kubernetes/apiserver.key** --leader-elect=true --pod-eviction-timeout=1m0s --logtostderr=true --v=2\r\n\r\n /opt/bin/kube-scheduler --master=127.0.0.1:8080 --leader-elect=true --logtostderr=true --v=2\r\n\r\n/opt/bin/kubelet --address=0.0.0.0 --port=10250 --pod-infra-container-image=registry-dev.baiwei.baidu.com/google_containers/pause:latest --api-servers=http://172.31.8.29:8080 --logtostderr=true --cluster-dns=172.31.96.100 --cluster-domain=cluster-cloud92.com --hostname-override=bjkjy-ite-cloud92.bjkjy --resolv-conf=\r\n\r\n /opt/bin/kube-proxy --master=http://172.31.8.29:8080 --logtostderr=true\r\n\r\n**kubectl get serviceaccount**\r\nNAME      SECRETS   AGE\r\ndefault   1         3d\r\n\r\n### Question:\r\nHow to track and fix this issue？\r\nHow to config the host cluster for init federation about authorization? \r\nDo i must use ca for host cluster?\r\n\r\n\r\n**What you expected to happen**:\r\n\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\n\r\n\r\n**Anything else we need to know**:\r\n\r\n\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/federation/issues/comments/340670470","html_url":"https://github.com/kubernetes/federation/issues/110#issuecomment-340670470","issue_url":"https://api.github.com/repos/kubernetes/federation/issues/110","id":340670470,"user":{"login":"irfanurrehman","id":10027921,"avatar_url":"https://avatars0.githubusercontent.com/u/10027921?v=4","gravatar_id":"","url":"https://api.github.com/users/irfanurrehman","html_url":"https://github.com/irfanurrehman","followers_url":"https://api.github.com/users/irfanurrehman/followers","following_url":"https://api.github.com/users/irfanurrehman/following{/other_user}","gists_url":"https://api.github.com/users/irfanurrehman/gists{/gist_id}","starred_url":"https://api.github.com/users/irfanurrehman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/irfanurrehman/subscriptions","organizations_url":"https://api.github.com/users/irfanurrehman/orgs","repos_url":"https://api.github.com/users/irfanurrehman/repos","events_url":"https://api.github.com/users/irfanurrehman/events{/privacy}","received_events_url":"https://api.github.com/users/irfanurrehman/received_events","type":"User","site_admin":false},"created_at":"2017-10-31T06:13:43Z","updated_at":"2017-10-31T06:13:43Z","author_association":"MEMBER","body":"<a href=\"https://github.com/irfanurrehman\"><img src=\"https://avatars0.githubusercontent.com/u/10027921?v=4\" align=\"left\" width=\"48\" height=\"48\" hspace=\"10\"></img></a> **Comment by [irfanurrehman](https://github.com/irfanurrehman)**\n_Friday Apr 07, 2017 at 10:03 GMT_\n\n----\n\n@saturnism can u please confirm as per my previous question.\r\nIs ur base cluster API server running with ```--authorization-mode=RBAC```, if not will it be possible for you to do that change and then try kubefed init again.\r\n\n"}}
{"actor":{"display_login":"irfanurrehman"}}