system:serviceaccount:default:istio-pilot-service-account" cannot create customresourcedefinitions.apiextensions.k8s.io at the cluster scope

[rainard]

when I do "kubectl apply -f istio.yaml",It cann't work .How can I fix it

default       istio-egress-261638103-bdwr3            1/1       Running                            
default       istio-ingress-4062434106-x5njq          1/1       Running                         
default       istio-mixer-2284716121-vx5kn            2/2       Running                    
default       istio-pilot-3717782336-dvnf3            0/1       CrashLoopBackOff   12     

#kubectl logs  istio-pilot-3717782336-dvnf3    

I0817 08:18:07.809503     123 main.go:79] mesh configuration (*istio_proxy_v1_config.ProxyMeshConfig)(0xc420090f00)(egress_proxy_address:"istio-egress:80" discovery_address:"istio-pilot:8080" mixer_address:"istio-mixer:9091" zipkin_address:"zipkin:9411" statsd_udp_address:"istio-mixer:9125" proxy_listen_port:15001 proxy_admin_port:15000 drain_duration:<seconds:2 > parent_shutdown_duration:<seconds:3 > istio_service_cluster:"istio-proxy" discovery_refresh_delay:<seconds:1 > connect_timeout:<seconds:1 > ingress_class:"istio" ingress_service:"istio-ingress" ingress_controller_mode:STRICT auth_certs_path:"/etc/certs" )
Error: failed to register custom resources. User "system:serviceaccount:default:istio-pilot-service-account" cannot create customresourcedefinitions.apiextensions.k8s.io at the cluster scope. (post customresourcedefinitions.apiextensions.k8s.io)

........

 failed to register custom resources. User "system:serviceaccount:default:istio-pilot-service-account" cannot create customresourcedefinitions.apiextensions.k8s.io at the cluster scope. (post customresourcedefinitions.apiextensions.k8s.io)

[ldemailly]

Thx for trying istio out, can you file your issue in
https://github.com/istio/issues/issues
also indicate the exact versions you are using ?

this looks like an rbac/rule issue we think we fixed in latest code

[andraxylia]

I have the same issue, there was another recent change in the pilot code that is not covered by the latest rbac rules.

[andraxylia]

The workaround is to give the pilot service account cluster-admin role:

kubectl create clusterrolebinding cluster-admin-binding-2   --clusterrole=cluster-admin   --user=system:serviceaccount:default:istio-pilot-service-account

If deploying istio in a different namespace than "default", replace "default" in "system:serviceaccount:default:istio-pilot-service-account" with the actual namespace.

[andraxylia]

What k8s version do you have? I started getting this with 1.7.3. although all RBAC rules are in place.

[gyliu513]

@andraxylia we may need to add cdr to the role of isto-pilot here https://github.com/istio/istio/blob/master/install/kubernetes/istio-rbac-beta.yaml#L21 , but I did not found where we defined the cdr, can you point this out? Thanks.

[andraxylia]

The CDR permissions are defined here:

https://github.com/istio/istio/blob/master/install/kubernetes/istio-rbac-beta.yaml#L15

[andraxylia]

Can you also try the command below), as described here, and let me know if it fixes the problem?

(https://github.com/kelseyhightower/istio-ingress-tutorial/blob/master/docs/03-kubernetes-infrastructure.md)

kubectl create clusterrolebinding cluster-admin-binding \
  --clusterrole=cluster-admin \
  --user=$(gcloud config get-value core/account)

[gyliu513]

@andraxylia it is weird as we already defined the CDR permission already. Did you find which resource need to depend on CDR? I did not found the template where defined the CDR resources.

[andraxylia]

Have you tried the command above, if you are using GKE? If you are using another k8s, just replace --user= ... with your actual user.

[gyliu513]

@andraxylia I did not encounter this problem, just curious why failed even we have already defined the CDR permission for the user of istio-pilot. Also I did not find which template in istio is using CDR

[andraxylia]

Pilot and mixer will use CRDs (Custom Resource Definitions).
I will close this issue for now, please re-open if you still have it.