Enable RBAC by default #1722
Enable RBAC by default #1722
Comments
Allow kube-dns and other kube-system services full access to the API. See: * kubernetes/minikube#1734 * kubernetes/minikube#1722
Automatic merge from submit-queue. Fix kube-dns RBAC issues Allow kube-dns and other kube-system services full access to the API. See: * kubernetes/minikube#1734 * kubernetes/minikube#1722 Fixes: #107 **Release note**: ```release-note NONE ```
Issues go stale after 90d of inactivity. Prevent issues from auto-closing with an If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or |
This would still be super desirable to have from my perspective. Happy to drive a change if there's consensus on the usefulness of the feature. /remove-lifecycle stale |
This would be a great change to help keep local development and cluster in sync. |
+1. us operators are finding devs that use minikube for development often don't come up with the right rbac rules that would allow the system to work when handed to us. |
+1. Struggling through a bunch of issues because I assumed minikube would work OOTB with RBAC enabled. Looks like at least kube-dns still needs RBAC rules tweaked to work correctly under RBAC (this is from minikube v0.25.0):
|
It also happen to me, when I run kub-dns and kub-dashboard not able to run |
Ref: https://gist.github.com/F21/08bfc2e3592bed1e931ec40b8d2ab6f5 The above gist added |
will this make it in for 1.10? |
It appears that the kube-dns pod fails when minikube is started with Rather than granting a blanket I created the |
Also, kubernetes-dashboard fails due to using the default service account without the necessary role/permissions granted. I fixed this with It would probably also reasonable to apply https://github.com/kubernetes/dashboard/blob/v1.8.1/src/deploy/alternative/kubernetes-dashboard.yaml directly if its Service definition used a NodePort. |
To be honest, I am surprised that RBAC is not enabled by default. Expected the same behavior across all kubernetes providers. If I want to use GKE, I can't just take everything prepared in minikube and deploy it to GKE, it will not work due to RBAC errors :) |
I believe this issue has been fixed. Since minikube
|
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
Is this a BUG REPORT or FEATURE REQUEST? (choose one): feature-request
Enable RBAC in the k8s cluster by default. A lot of tools do this already (hack/cluster-up, kubeadm, etc.). So it might bring minikube closer to CI/test/production environments. I think it would only entail changing some of the cluster addons and enabling the flag.
The text was updated successfully, but these errors were encountered: