Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"error":"mutatingwebhookconfigurations.admissionregistration.k8s.io is forbidden: #8

Open
noptanakhon opened this issue Feb 4, 2021 · 1 comment

Comments

@noptanakhon
Copy link

kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.2", GitCommit:"faecb196815e248d3ecfb03c680a4507229c2a56", GitTreeState:"clean", BuildDate:"2021-01-13T13:25:59Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}

kubectl logs podpreset-webhook-68c4ffbb8b-ptw9b

{"level":"info","ts":1612442241.8420184,"logger":"cmd","msg":"Go Version: go1.12"}
{"level":"info","ts":1612442241.8420722,"logger":"cmd","msg":"Go OS/Arch: linux/amd64"}
{"level":"info","ts":1612442241.8420768,"logger":"cmd","msg":"Version of operator-sdk: v0.10.0"}
{"level":"info","ts":1612442242.0041437,"logger":"cmd","msg":"Registering Components."}
{"level":"info","ts":1612442242.3313715,"logger":"cmd","msg":"Could not create ServiceMonitor object","error":"no ServiceMonitor registered with the API"}
{"level":"info","ts":1612442242.3314064,"logger":"cmd","msg":"Install prometheus-operator in your cluster to create ServiceMonitor objects","error":"no ServiceMonitor registered with the API"}
{"level":"info","ts":1612442242.3314116,"logger":"cmd","msg":"Starting the Cmd."}
{"level":"info","ts":1612442242.431955,"logger":"kubebuilder.webhook","msg":"installing webhook configuration in cluster"}
{"level":"error","ts":1612442242.5360901,"logger":"cmd","msg":"Manager exited non-zero","error":"mutatingwebhookconfigurations.admissionregistration.k8s.io is
forbidden: User "system:serviceaccount:default:podpreset-webhook" cannot create resource "mutatingwebhookconfigurations" in API group "admissionregistration.k8s.io" at the cluster scope","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/home/travis/gopath/pkg/mod/github.com/go-logr/[email protected]/zapr.go:128\nmain.main\n\t/home/travis/gopath/src/github.com/redhat-cop/podpreset-webhook/cmd/manager/main.go:142\nruntime.main\n\t/home/travis/.gimme/versions/go1.12.linux.amd64/src/runtime/proc.go:200"}

@tfluehmann
Copy link

tfluehmann commented Feb 8, 2021

Tried it out in gke (k8s version 1.17). It displays the same error.
Despite it should have the permission:

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: podpreset-webhook
subjects:
  - kind: ServiceAccount
    name: podpreset-webhook
    namespace: podpreset-webhook
roleRef:
  kind: ClusterRole
  name: podpreset-webhook
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: podpreset-webhook
rules:
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - list
      - get
      - create
  - apiGroups:
      - redhatcop.redhat.io
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - mutatingwebhookconfigurations
    verbs:
      - "*"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants