Having a problem adding a ClusterRoleBinding not sure if it Pulumi Community #general

Having a problem adding a ClusterRoleBinding - not...

important-leather-28796

03/15/2019, 6:07 PM

Having a problem adding a ClusterRoleBinding - not sure if it is with my gcp identities setup or in k8s. Error:

Copy code

<http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> is forbidden: User "<mailto:ci-infrastructure@xxx.iam.gserviceaccount.com|ci-infrastructure@xxx.iam.gserviceaccount.com>" cannot create resource "clusterrolebindings" in API group "<http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>" at the cluster scope

I verified this roleRef/subjects from a manually created one:

Copy code

const name = 'cluster-admin-binding'
export const clusterAdminBinding = new k8s.rbac.v1.ClusterRoleBinding(
  name,
  {
    metadata: { name },
    roleRef: {
      apiGroup: '<http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>',
      kind: 'ClusterRole',
      name: 'cluster-admin',
    },
    subjects: [
      {
        apiGroup: '<http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>',
        kind: 'User',
        name: stack.identity.getOutput('ciInfrastructure').apply(v => v.email),
      },
    ],
  },
  optsC({ dependsOn: [cluster] }),
)

What am I missing?

important-leather-28796

03/15/2019, 6:08 PM

Here is the identity setup:

Copy code

const name = 'ciInfrastructure'

export const ciInfrastructure = new gcp.serviceAccount.Account(
  name,
  {
    project,
    accountId: 'ci-infrastructure',
    displayName: 'CI infrastructure account',
  },
  { protect },
)

bindToIAMRole(`${name}ClusterAdmin`, ciInfrastructure, {
  project,
  role: 'roles/container.clusterAdmin',
})
// for deploying cluster-wide resources e.g. traefik, cert-manager
bindToIAMRole(`${name}ContainerDeveloper`, ciInfrastructure, {
  project,
  role: 'roles/container.developer',
})

important-leather-28796

03/15/2019, 6:09 PM

I thought since I can use the

ci-infrastructure

gcp service account/identity to create the cluster, that I’ll be able to create a clusterRoleBinding, but so far cannot.

important-leather-28796

03/15/2019, 6:21 PM

I’m going to go back and try with

roles/container.admin

, using

container.clusterAdmin

and

container.developer

may not be enough

important-leather-28796

03/15/2019, 6:21 PM

https://cloud.google.com/kubernetes-engine/docs/how-to/iam

important-leather-28796

03/15/2019, 6:32 PM

changing the gcp IAM role to

'roles/container.admin'

solved it

creamy-potato-29402

03/15/2019, 9:42 PM

@important-leather-28796 not an expert but that seems to be a lack of permissions error

creamy-potato-29402

03/15/2019, 9:43 PM

creamy-potato-29402

03/15/2019, 9:43 PM

didn’t see last message

Open in Slack

Previous Next