[stable/nginx-ingress] k8s 1.6 - perms

[ReSearchITEng]

brand new 1.6 cluster:

helm install stable/nginx-ingress --name my-release
Error: release my-release failed: the server does not allow access to the requested resource (get namespaces default)

versions:
k8s: 1.6.1
helm: v.2.3.1
stable/nginx-ingress: 0.3.2

maybe due RBAC of k8s 1.6?
This looks related: https://www.bountysource.com/issues/43945543-kubeadm-using-1-6-ingess-controller-can-t-access-api
this looks like a good start: jetstack/kube-lego#99

[prydonius]

@ReSearchITEng yes, looks like RBAC is the issue here. Should be easy to add the Role resources to the chart.

[iantanwx]

I can confirm this 'bug' on kubeadm 1.6.2. I was able to reproduce and fix by going through the usual steps to install nginx-ingress, and then manually editing the deployment afterward.

[iantanwx]

Is there a good way to solve this problem using the helm CLI? It does not seem that there is an easy way to automate the process.

[noonien]

Any updates on this?

[ReSearchITEng]

For nginx-ingress, in case you don't want to give all perms to all(https://github.com/ReSearchITEng/kubeadm-playbook/raw/master/allow-all-all-rbac.yml), one has to tune: https://raw.githubusercontent.com/kubernetes/ingress/master/examples/rbac/nginx/nginx-ingress-controller-rbac.yml or, even better, add it in the helm chart.

[ReSearchITEng]

To be fixed by PR in #1235

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close