Skip to content
This repository has been archived by the owner on Sep 5, 2024. It is now read-only.

RBAC with config file from Rancher fails #618

Open
rancher-max opened this issue Oct 28, 2019 · 3 comments
Open

RBAC with config file from Rancher fails #618

rancher-max opened this issue Oct 28, 2019 · 3 comments
Labels
bug Something isn't working
Milestone

Comments

@rancher-max
Copy link
Contributor

Describe the bug
Using a Kubeconfig file for a GKE cluster from Rancher and adding impersonation headers to it for RBAC causes failure when running rio commands: FATA[0000] {"Code":{"Code":"Forbidden","Status":403},"Message":"clusters.management.cattle.io \"c-ghd74\" is forbidden: User \"rio-admin\" cannot get resource \"clusters\" in API group \"management.cattle.io\" at the cluster scope","Cause":null,"FieldName":""} (get rioinfos.admin.rio.cattle.io rio)

To Reproduce

  1. Use Rancher to create a GKE cluster
  2. After the cluster has been provisioned, save the KUBECONFIG file locally. Update the users.user section to also have:
    as: rio-admin
    as-groups:
    - rio:admin
  1. Run rio info or any rio command that reaches out to the cluster. It will fail

Expected behavior
Proxy the impersonation header through so as to have RBAC in rio.

Kubernetes version & type (GKE, on-prem): kubectl version

Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.0", GitCommit:"2bd9643cee5b3b3a5ecbd3af49d09018f0773c77", GitTreeState:"clean", BuildDate:"2019-09-19T13:57:45Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"14+", GitVersion:"v1.14.7-gke.10", GitCommit:"8cea5f8ae165065f0d35e5de5dfa2f73617f02d1", GitTreeState:"clean", BuildDate:"2019-10-05T00:08:10Z", GoVersion:"go1.12.9b4", Compiler:"gc", Platform:"linux/amd64"}

Type:
Rio version: rio info

Rio Version: v0.6.0-alpha.1 (7678d67d)
Rio CLI Version: v0.6.0-alpha.1 (7678d67d)
@rancher-max rancher-max added the bug Something isn't working label Oct 28, 2019
@davidnuzik davidnuzik added this to the v0.6.x milestone Nov 1, 2019
@rancher-max
Copy link
Contributor Author

This issue still applies as Cluster Owner and with an RKE cluster, on rio v0.6.0-alpha.2

@izaac
Copy link

izaac commented Nov 11, 2019

This issue still applies for rio v0.6.0-alpha.4 k3s v0.10.2 using a kubeconfig file generated by Rancher 2.3.2 @StrongMonkey

#623

@davidnuzik davidnuzik modified the milestones: v0.6.x, v0.7.0, v0.8.0 Nov 22, 2019
@davidnuzik
Copy link
Contributor

Depends on completion of #878

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants