You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
k9s relies on access to selfsubjectaccessreviews and access to all namespaces. Requesting to remove that requirement please so that cluster with only specific namespace can be visualized in k9s tool.
It is possible to connect to kubernetes cluster using kubectl properly. kubectl get pods / kubectl get jobs command give successful response.
However trying to connect using k9s keeps giving error:
kubectl get pods
NAME READY STATUS RESTARTS AGE
shmpri-p-jg8lh 0/1 ImagePullBackOff 0 21h
k9s -n $MY_NAMESPACE_NAME
Error: [list] access denied on resource "shmpri":"v1/pods"
...
panic: [list] access denied on resource "shmpri":"v1/pods"
goroutine 1 [running]:
github.com/derailed/k9s/cmd.Execute()
github.com/derailed/k9s/cmd/root.go:72 +0x80
main.main()
github.com/derailed/k9s/main.go:32 +0x1c
K9s logs indicate error in accessing selfsubjectaccessreviews and all namespace list ... our admin can't provide access to these for security reasons.
�[90m2:08PM�[0m �[32mINF�[0m �[1m🐶 K9s starting up...�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1m Dial Failed!�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1mnamespace validation failed for: "shmpri"�[0m �[36merror=�[0m�[31m�[1m"user not authorized to list all namespaces"�[0m�[0m
�[90m2:08PM�[0m �[32mINF�[0m �[1m✅ Kubernetes connectivity�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1mnamespace validation failed for: "shmpri"�[0m �[36merror=�[0m�[31m�[1m"user not authorized to list all namespaces"�[0m�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1m Dial Failed!�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1m Dial Failed!�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1mFail CRDs load�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[33mWRN�[0m �[1m Dial Failed!�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[31mERR�[0m �[1mComponent init failed for "Pod"�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[31mERR�[0m �[1mDefault run command failed "pod"�[0m �[36merror=�[0m�[31m�[1m"selfsubjectaccessreviews.authorization.k8s.io is forbidden: User \"unicman\" cannot create resource \"selfsubjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope: Authorization failed"�[0m�[0m
�[90m2:08PM�[0m �[31mERR�[0m �[1mComponent init failed for "Pod"�[0m �[36merror=�[0m�[31m�[1m"[list] access denied on resource \"shmpri\":\"v1/pods\""�[0m�[0m
To Reproduce
Steps to reproduce the behavior:
Create kubernetes cluster.
Create namespace 'shmpri'.
Remove access to selfsubjectaccessreviews and all namespaces to user account 'unicman'. Give full access to 'unicman' for all resources of namespace 'shmpri'. This includes resources like pods and services but not ones like namespaces and nodes.
brew install kubernetes-cli on Mac laptop.
brew install k9s on Mac laptop.
Generate kubeconfig to connect to cluster and specifically namespace 'shmpri'. Ensure ~/.kube/config is present.
Execute kubectl apply -f <sample.yaml> . sample.yaml can be any standard pod / job deployment. Issue is not about it so it doesn't matter what you would use.
Execute kubectl get pods . Ensure that pod(s) are visible in 'shmpri' namespace.
Execute k9s . Expected behavior is text UI would open and allow k8s resources to be viewed. But it fails.
Execute k9s -n shmpri . Expected behavior is text UI would open and allow k8s resources to be viewed. But it fails.
Historical Documents
N/A
Expected behavior
k9s should allow traversing all pods and jobs etc in namespace 'shmpri'.
Screenshots
Console output pasted above.
Versions (please complete the following information):
Describe the bug
k9s relies on access to selfsubjectaccessreviews and access to all namespaces. Requesting to remove that requirement please so that cluster with only specific namespace can be visualized in k9s tool.
It is possible to connect to kubernetes cluster using kubectl properly. kubectl get pods / kubectl get jobs command give successful response.
However trying to connect using k9s keeps giving error:
K9s logs indicate error in accessing selfsubjectaccessreviews and all namespace list ... our admin can't provide access to these for security reasons.
To Reproduce
Steps to reproduce the behavior:
brew install kubernetes-cli
on Mac laptop.brew install k9s
on Mac laptop.~/.kube/config
is present.kubectl apply -f <sample.yaml>
. sample.yaml can be any standard pod / job deployment. Issue is not about it so it doesn't matter what you would use.kubectl get pods
. Ensure that pod(s) are visible in 'shmpri' namespace.k9s
. Expected behavior is text UI would open and allow k8s resources to be viewed. But it fails.k9s -n shmpri
. Expected behavior is text UI would open and allow k8s resources to be viewed. But it fails.Historical Documents
N/A
Expected behavior
k9s should allow traversing all pods and jobs etc in namespace 'shmpri'.
Screenshots
Console output pasted above.
Versions (please complete the following information):
Additional context
N/A
The text was updated successfully, but these errors were encountered: