Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ServiceAccounts for kube-apiserver and kube-scheduler #370

Merged
merged 1 commit into from
Jan 2, 2019
Merged

Add ServiceAccounts for kube-apiserver and kube-scheduler #370

merged 1 commit into from
Jan 2, 2019

Conversation

dghubble
Copy link
Member

@dghubble dghubble commented Jan 2, 2019 •
edited
Loading

  • Add separate ServiceAccounts and ClusterRoleBindings for kube-apiserver and kube-scheduler
  • Remove the ClusterRoleBinding for the kube-system default ServiceAccount
  • Rename the CA certificate CommonName for consistency with upstream

rel: poseidon/terraform-render-bootstrap#99

@dghubble dghubble changed the title Add ServiceAccounts for kube-apiserver and kube-scheduerl Add ServiceAccounts for kube-apiserver and kube-scheduler Jan 2, 2019
@dghubble dghubble force-pushed the require-service-accounts branch 2 times, most recently from a82f0f4 to 60dc380 Compare January 2, 2019 04:15
@dghubble
Add ServiceAccounts for kube-apiserver and kube-scheduler
66e1365 
* Add ServiceAccounts and ClusterRoleBindings for kube-apiserver
and kube-scheduler
* Remove the ClusterRoleBinding for the kube-system default ServiceAccount
* Rename the CA certificate CommonName for consistency with upstream
@dghubble dghubble force-pushed the require-service-accounts branch from 60dc380 to 66e1365 Compare January 2, 2019 04:16
@dghubble dghubble mentioned this pull request Jan 2, 2019
Closed
@dghubble
Copy link
Member Author

dghubble commented Jan 2, 2019 •
edited
Loading

This surfaced an upstream bug (kubernetes/kubernetes#72473) similar to a kube-controller-manager one I fixed in v1.12.1. Fortunately, in the kube-scheduler case, the error is non-fatal.

W0102 03:31:23.167185       1 authentication.go:262] Unable to get configmap/extension-apiserver-authentication in kube-system.  Usually fixed by 'kubectl create rolebinding -n kube-system ROLE_NAME --role=exten
sion-apiserver-authentication-reader --serviceaccount=YOUR_NS:YOUR_SA'                                                                                                                                             
W0102 03:31:23.167220       1 authentication.go:199] Error looking up in-cluster authentication configuration: configmaps "extension-apiserver-authentication" is forbidden: User "system:serviceaccount:kube-syste
m:kube-scheduler" cannot get resource "configmaps" in API group "" in the namespace "kube-system"

Typhoon doesn't enable the aggregation extensions anway, so this should be ignored. I posted a PR to fix the system:kube-scheduler ClusterRole (hopefully in v1.13.2 🤞)

@dghubble dghubble merged commit 66e1365 into master Jan 2, 2019
@dghubble dghubble deleted the require-service-accounts branch January 2, 2019 06:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@dghubble