Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add --authentication-skip-lookup=true flag #91

Closed
thorn3r opened this issue Feb 22, 2021 · 0 comments · Fixed by #98
Closed

Add --authentication-skip-lookup=true flag #91

thorn3r opened this issue Feb 22, 2021 · 0 comments · Fixed by #98

Comments

@thorn3r
Copy link
Contributor

thorn3r commented Feb 22, 2021

The example deployment manifest for the Linode CCM uses the cluster-admin role. When deploying the CCM with a limited clusterrole, the CCM fails to start if it doesn't have access to get on configmaps:

W0222 19:11:17.239825       1 requestheader_controller.go:193] Unable to get configmap/extension-apiserver-authentication in kube-system.  Usually fixed by 'kubectl create rolebinding -n kube-system ROLEBINDING_NAME --role=extension-apiserver-authentication-reader --serviceaccount=YOUR_NS:YOUR_SA'
unable to load configmap based request-header-client-ca-file: configmaps "extension-apiserver-authentication" is forbidden: User "system:serviceaccount:kube-system:default" cannot get resource "configmaps" in API group "" in the namespace "kube-system"

This seems to be related to upstream issue, see: kubernetes/cloud-provider#34

It looks like Digital Ocean ran into a similar problem after updating their K8s deps (digitalocean/digitalocean-cloud-controller-manager#217). Possible short-term solutions could be to add the --authentication-skip-lookup=true flag to the deployment example manifest, or to hardcode this option in the binary

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant