Recipe 10.2 'Listing and viewing Access Control Information'

[bennybhlin]

I used the 'pod-with-sa.yaml' example here to create serviceaccount sec/myappsa; however, if I just enter the command of sec. 10.2 'kubectl -n sec auth can-i list pods --as=system-serviceaccount:sec:myappsa', I would get an error message below (no RBAC policy matched):

Even I'd follower recipe 10.3 to create required role and role binding under namespace 'sec', I still could not verify whether serviceaccount sec/myappsa is capable of get/list pods in namespace 'sec'.

What did I miss?

[bennybhlin]

Meanwhile. using Minikube 0.29.0 with '--extra-config=apiserver.Authorization.Mode=RBAC' would hang 'minikube start'.

kubernetes/minikube#2798

But later I used '--extra-config=apiserver.Authorization-Mode=RBAC' instead, the hang disappeared.

[mhausenblas]

You have a copy past mistake in there (I checked, it's correct in the book): it should be --as=system:serviceaccount:sec:myappsa and not --as=system-serviceaccount:sec:myappsa

[bennybhlin]

Sorry, but even I paste corrected snippet it still gave me another error, I am sure my role 'podreader' was created under namespace 'sec':

[bennybhlin]

Hi Michael I sill gor error via using --as=system:serviceaccount:sec:myappsa no - RBAC: role.rbac.authorization.k8s.io "sec:podreader" not found Can I reopen this issue? Michael Hausenblas <notifications@github.com> 於 2018年10月16日 週二 下午3:40寫道：

…

You have a copy past mistake in there (I checked, it's correct in the book): it should be --as=system:serviceaccount:sec:myappsa and not --as=system-serviceaccount:sec:myappsa — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#9 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AlDjxq7Sgai9zzayKVUj9yOvev4ZEaTuks5ulY16gaJpZM4Xdnnm> .

[mhausenblas]

Well, that's strange, isn't it? :)

What does kubectl version --short give you?

[bennybhlin]

I got this

[mhausenblas]

So @bennybhlin not sure about this one. I can't reproduce it as it stands. What exactly was your setup? What steps did you do?

[sebgoa]

Did you create the rolebinding as well ?

BTW: you can just paste the text output using triple quotes like this:

this is the text I have in my shell

instead of pasting pictures...