Skip to content
This repository has been archived by the owner on Apr 29, 2019. It is now read-only.

doing vagrant up I see this error... clusterroles.rbac.authorization.k8s.io "system:coredns" is forbidden: attempt to grant extra privileges #281

Open
tamxdx opened this issue Feb 14, 2018 · 1 comment

Comments

@tamxdx
Copy link

tamxdx commented Feb 14, 2018

I'm a kubernetes newbie. I'm not how much this affects things..

==> master: Configuring Kubernetes DNS...
serviceaccount "coredns" created
clusterrolebinding "system:coredns" created
configmap "coredns" created
deployment "coredns" created
service "coredns" created
Error from server (Forbidden): error when creating "temp/coredns-deployment.yaml": clusterroles.rbac.authorization.k8s.io "system:coredns" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["namespaces"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["namespaces"], APIGroups:[""], Verbs:["watch"]}] user=&{kube-admin [system:authenticated] map[]} ownerrules=[] ruleResolutionErrors=[]

@ikyatov
Copy link

ikyatov commented Mar 8, 2018

@tamxdx
The solution for me of a similar problem:
Comment in file coredns-deployment.yaml

# ---
# apiVersion: rbac.authorization.k8s.io/v1
# kind: ClusterRole
# metadata:
  # labels:
    # kubernetes.io/bootstrapping: rbac-defaults
    # addonmanager.kubernetes.io/mode: Reconcile
  # name: system:coredns
# rules:
# - apiGroups:
  # - ""
  # resources:
  # - endpoints
  # - services
  # - pods
  # - namespaces
  # verbs:
  # - list
  # - watch
# ---
# apiVersion: rbac.authorization.k8s.io/v1
# kind: ClusterRoleBinding
# metadata:
  # annotations:
    # rbac.authorization.kubernetes.io/autoupdate: "true"
  # labels:
    # kubernetes.io/bootstrapping: rbac-defaults
    # addonmanager.kubernetes.io/mode: EnsureExists
  # name: system:coredns
# roleRef:
  # apiGroup: rbac.authorization.k8s.io
  # kind: ClusterRole
  # name: system:coredns
# subjects:
# - kind: ServiceAccount
  # name: coredns
  # namespace: kube-system

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants