madeden / charts Goto Github PK

I have Prometheus and Grafana setup that is working fine.

When I deploy the custom-metrics-api-server charts, I hit a few issues:

1. It seems to be first missing a ServiceAccount definition, but later attempts to use one for creating role bindings.
2. After I added a ServiceAccount definition to match what the rolebinding yaml was expecting, I see the following error in the custom-metrics-apiserver pod:

Logs:

ubuntu@ip-172-30-xxx:~/source/charts$ kubectl logs po/sad-gibbon-custom-metrics-apiserver-250099130-6t9ns

I0616 01:09:47.137615 20 loader.go:357] Config loaded from file /var/run/kubeconfig/kubeconfig
I0616 01:09:47.138230 20 round_trippers.go:386] curl -k -v -XGET -H "User-Agent: prometheus-adapter/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Accept: application/json, /" -H "Authorization: Basic YWRXYZ76aFzcw==" https://10.96.0.1:443/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication
I0616 01:09:47.142803 20 round_trippers.go:405] GET https://10.96.0.1:443/api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication 403 Forbidden in 4 milliseconds
I0616 01:09:47.142833 20 round_trippers.go:411] Response Headers:
I0616 01:09:47.142843 20 round_trippers.go:414] Content-Length: 77
I0616 01:09:47.142849 20 round_trippers.go:414] Date: Sat, 16 Jun 2018 01:09:47 GMT
I0616 01:09:47.142857 20 round_trippers.go:414] Content-Type: text/plain
I0616 01:09:47.142863 20 round_trippers.go:414] X-Content-Type-Options: nosniff
I0616 01:09:47.142898 20 request.go:991] Response Body: User "system:anonymous" cannot get configmaps in the namespace "kube-system".
W0616 01:09:47.142964 20 authentication.go:222] Unable to get configmap/extension-apiserver-authentication in kube-system. Usually fixed by 'kubectl create rolebinding -n kube-system ROLE_NAME --role=extension-apiserver-authentication-reader --serviceaccount=YOUR_NS:YOUR_SA'
Error: User "system:anonymous" cannot get configmaps in the namespace "kube-system". (get configmaps extension-apiserver-authentication)

Its not clear to me why the error says 'system:anonymous'. Shouldn't it be using the service-account that I added?

I added the ServiceAccount as such:

{{- if .Values.rbac.install -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "custom-metrics-apiserver.fullname" . }}
  namespace: {{ .Release.Namespace }}
{{- end -}}

I do see the Pod using the serviceAccount:

kubectl get pods sad-gibbon-custom-metrics-apiserver-250099130-6t9ns -o yaml
...
  serviceAccountName: sad-gibbon-custom-metrics-apiserver

Also, rolebinding seems to be okay:

ubuntu@ip-172-30-xxx:~/source/charts$ kubectl describe rolebindings custom-metrics-auth-reader
Name:           custom-metrics-auth-reader
Labels:         <none>
Annotations:    <none>
Role:
  Kind: Role
  Name: extension-apiserver-authentication-reader
Subjects:
  Kind                  Name                                    Namespace
  ----                  ----                                    ---------
  ServiceAccount        sad-gibbon-custom-metrics-apiserver     default

version:

ubuntu@ip-172-30-xxx:~$ kubectl version
Client Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.5", GitCommit:"17d7182a7ccbb167074be7a87f0a68bd00d58d97", GitTreeState:"clean", BuildDate:"2017-08-31T09:14:02Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.5", GitCommit:"17d7182a7ccbb167074be7a87f0a68bd00d58d97", GitTreeState:"clean", BuildDate:"2017-08-31T08:56:23Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

What am I missing? Any pointers?