What are the proper RBAC permissions for Gloo to read inside k8s/openshift about gloo

[ilackarms]

can you give more detail on the steps you took and what went wrong? are you following the petstore tutorial?
glooctl get upstreams should return something like this:

glooctl get upstream
+--------------------------------+------------+----------+------------------------------+
|            UPSTREAM            |    TYPE    |  STATUS  |           DETAILS            |
+--------------------------------+------------+----------+------------------------------+
| default-kubernetes-443         | Kubernetes | Accepted | svc name:      kubernetes    |
|                                |            |          | svc namespace: default       |
|                                |            |          | port:          8443          |
|                                |            |          |                              |
| default-petstore-8080          | Kubernetes | Accepted | svc name:      petstore      |
|                                |            |          | svc namespace: default       |
|                                |            |          | port:          8080          |
|                                |            |          | REST service:                |
|                                |            |          | functions:                   |
|                                |            |          | - addPet                     |
|                                |            |          | - deletePet                  |
|                                |            |          | - findPetById                |
|                                |            |          | - findPets                   |
|                                |            |          |                              |
| gloo-system-gateway-proxy-8080 | Kubernetes | Accepted | svc name:      gateway-proxy |
|                                |            |          | svc namespace: gloo-system   |
|                                |            |          | port:          8080          |
|                                |            |          |                              |
| gloo-system-gloo-9977          | Kubernetes | Accepted | svc name:      gloo          |
|                                |            |          | svc namespace: gloo-system   |
|                                |            |          | port:          9977          |
|                                |            |          |                              |
+--------------------------------+------------+----------+------------------------------+

[ilackarms]

you can see how we're setting up rbac for gloo in https://github.com/solo-io/gloo/blob/master/install/kube.yaml

[DaleBingham]

I am following the petstore tutorial, however I did not want it in "default" so I made a "petstore" project/namespace with the below and edited the YAML locally to use that namespace. I see the petstore, but the auto discovery did not work. I am using the latest minishift with OKD 3.11 FYI. I also have my own dotnet core webapi with a /swagger.json that spits out proper JSON for Swagger 2.0 for my API and it also did not discover that. So I was questioning the permissions required. I will look at that URL thank you for the quick reply.

oc new-project petstore

[ilackarms]

i understand. to explain, gloo (should) have the correct RBAC configuration:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: gloo-role
rules:
- apiGroups: [""]
  resources: ["pods", "services", "secrets", "endpoints", "configmaps"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "create"]
- apiGroups: ["gloo.solo.io"]
  resources: ["settings", "upstreams", "proxies","virtualservices"]
  verbs: ["*"]
- apiGroups: ["sqoop.solo.io"]
  resources: ["schemas"]
  verbs: ["*"]
- apiGroups: ["gateway.solo.io"]
  resources: ["virtualservices", "gateways"]
  verbs: ["*"]

applied to the gloo-system namespace.

the issue here is that Gloo maintains a whitelist of namespaces in which discovery runs.
It's on our road map to add cli support for modifying this whitelist, but right now you can do it with kubectl by running kubectl edit settings -n gloo-system default

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: gloo.solo.io/v1
kind: Settings
metadata:
  clusterName: ""
  creationTimestamp: 2018-12-26T21:31:42Z
  generation: 1
  name: default
  namespace: gloo-system
  resourceVersion: "426372"
  selfLink: /apis/gloo.solo.io/v1/namespaces/gloo-system/settings/default
  uid: a3224e8e-0955-11e9-b0c6-50031de3a37c
spec:
  DevMode: true
  bindAddr: 0.0.0.0:9977
  discoveryNamespace: gloo-system
  kubernetesArtifactSource: {}
  kubernetesConfigSource: {}
  kubernetesSecretSource: {}
  refreshRate: 60s
  watchNamespaces: # <-- you'll want to edit right here
  - default
  - gloo-system
status: {}

add any/remove any namespaces in watchNamespaces to see upstreams get added / removed for services in that ns.

function discovery should then see the petstore upstream and be able to detect its functions. please let us know if this resolves your issue.

[DaleBingham]

Ahhhhh that is what I was missing thank you! I will try that out.

[rickducott]

@DaleBingham @ilackarms anything to fix here? If not I'll close the issue out.

[DaleBingham]

No I just need to set RBAC to read other projects. Dale Bingham

…

On Dec 28, 2018, at 12:12 PM, Rick Ducott ***@***.***> wrote: @DaleBingham @ilackarms anything to fix here? If not I'll close the issue out. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[rickducott]

Cheers