-
Notifications
You must be signed in to change notification settings - Fork 7.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix misc RBAC issues on 1.6.6 #477
Conversation
Any way to get a test for this (failing without the fix and passing with it) ? Also can you describe a bit the fix/symptoms etc by editing the PR description (if we want to put this in the stable release-0.1 branch we need to be extra descriptive with the changes) |
Jenkins job istio/presubmit passed |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It seems in 1.6.6 ClusterRoleBinding works - and RoleBinding no longer works. The error message (user not found) doesn't make sense either.
So +1 to fix the tests - we don't officially document running in a namespace.
Create a cluster in GKE with 1.6.6 version and deploy istio, then do kubectl logs pilot-... , kubectl logs ingress-.... |
…lachie83/istio into bugfix-resync-alpha-beta-rbac-manifests * 'bugfix-resync-alpha-beta-rbac-manifests' of github.com:lachie83/istio: Fix misc RBAC issues on 1.6.6 (istio#477)
Also, fix python generation logic to stop passing directory names as proto files. This eliminates a bunch of warnings when building the repo, and eliminates a bunch of broken dud checked in files.
* update envoy sha adding regex match support in routes * no more filter types * more nixing * interactive compilation with Jenkins * hopefully the last compilation fix * one more * one more * another one
And remove values_gke.yaml Closes istio#18576
* WIP: Refine e2e implementation This is a refinement based upon the prior PRs in this area. Depends-On: istio/tools#483 * Use proper image with jq
[jaeger] Add option to configure ingester only via environment variables
I upgraded to a k8s 1.6.6 cluster and pilot can no longer read TPRs.
I0718 23:23:06.618825 1 client.go:194] TPR "IstioConfig" is not ready (User "system:serviceaccount:istio-test-nb5kb:istio-pilot-service-account" cannot list istioconfigs.istio.io at the cluster scope.: "Unknown user "system:serviceaccount:istio-test-nb5kb:istio-pilot-service-account"" (get IstioConfigs.istio.io)). Waiting...
Fixed also Ingress status, who was no longer updated after adding the k8s Syncer, because we were missing list permissions on the nodes.
This version is now in sync with the e2e tests in pilot, that can be run independently on an RBAC enabled cluster.