service catalog does not have enough access to run

[0xmichalis]

I0625 13:48:41.747136       1 feature_gate.go:190] feature gates: map[OriginatingIdentity:true]
I0625 13:48:41.747270       1 hyperkube.go:192] Service Catalog version v3.10.0-rc.0+8d6748f-dirty (built 2018-06-23T19:27:11Z)
W0625 13:48:42.314600       1 authentication.go:232] Unable to get configmap/extension-apiserver-authentication in kube-system.  Usually fixed by 'kubectl create rolebinding -n kube-system ROLE_NAME --role=extension-apiserver-authentication-reader --serviceaccount=YOUR_NS:YOUR_SA'
Error: configmaps "extension-apiserver-authentication" is forbidden: User "system:serviceaccount:hcp:default" cannot get configmaps in the namespace "kube-system": User "system:serviceaccount:hcp:default" cannot get configmaps in project "kube-system"

[0xmichalis]

We need to duplicate configmap extension-apiserver-authentication in both the hcp and the ccp. :/

@jim-minter

[jim-minter]

I was thinking we might be able to make it work whereby the HCP SC crashlooped until the addon manager added extension-apiserver-authentication.

[0xmichalis]

Ah, we probably want to disable mounting the default service account token and mount a kubeconfig that can make the service catalog talk to the ccp.