-
Notifications
You must be signed in to change notification settings - Fork 133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
kubectl cmd from kritis preinstall auth failure #589
Comments
Some followup material, after testing things out, now I really don't know where that kubectl command is getting its credentials, it doesn't appear to be its own service account. I am fortunate enough to have an istio proxy sidecar running, which mounts the same SA token:
note the last mount path is the kritis preinstall token. So I exec into there and using that token I am authorized just fine:
Same IP is resolved and everything, I even went to the certificates api group just to list the one that the kubectl call was trying to make. So I guess my question becomes, where is this kubectl call from within pre-install getting its credentials from? |
Expected Behavior
successful kubectl call from within kritis preinstall container
Actual Behavior
Steps to Reproduce the Problem
Environment, commands
I used the standalone docs, im really interested in this toolchain so demo-ing for my team.
./setup_grafeas.sh
./setup_kritis.sh
Additional info
basically, it seems like the kubectl call isn't authorized. Do see the service account exists:
as is its clusterrolebinding:
but I cant tell by looking at the golang (im a beginner/intermediate at golang at best) where its getting its kubeconf from or if its trying to use the service account token. It is noteworthy that other things I'm running that have an SA and require kube-api access arent being rejected. Any ideas?
The text was updated successfully, but these errors were encountered: