mirrors
/
kubernetes-the-hard-way
mirror of https://github.com/kelseyhightower/kubernetes-the-hard-way
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Update 13-kube-apiserver-to-kubelet.md 

I kept getting error as the user is `system:kube-apiserver` and not 'kube-apiserver'. Also, the description says user as kubernetes which should also be rather `system:kube-apiserver`

below is the error I received and corrected the CRB manifest after looking carefully at the User attribute in the error received.
```
~ at ☸️  kubernetes-the-hard-way
➜ kubectl logs weave-net-7bmxs weave -n kube-system
Error from server (Forbidden): Forbidden (user=system:kube-apiserver, verb=get, resource=nodes, subresource=proxy) ( pods/log weave-net-7bmxs)
```
pull/634/head
Sulabh Chaturvedi 2020-04-17 12:33:19 +01:00 committed by GitHub
parent 9b4e78e68e
commit 38918b3d5a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/13-kube-apiserver-to-kubelet.md
View File

@ -32,9 +32,9 @@ EOF
``` ```
Reference: https://v1-12.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole Reference: https://v1-12.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
The Kubernetes API Server authenticates to the Kubelet as the `kubernetes` user using the client certificate as defined by the `--kubelet-client-certificate` flag. The Kubernetes API Server authenticates to the Kubelet as the `system:kube-apiserver` user using the client certificate as defined by the `--kubelet-client-certificate` flag.
Bind the `system:kube-apiserver-to-kubelet` ClusterRole to the `kubernetes` user: Bind the `system:kube-apiserver-to-kubelet` ClusterRole to the `system:kube-apiserver` user:
``` ```
cat <<EOF | kubectl apply --kubeconfig admin.kubeconfig -f - cat <<EOF | kubectl apply --kubeconfig admin.kubeconfig -f -
@ -50,7 +50,7 @@ roleRef:
subjects: subjects:
- apiGroup: rbac.authorization.k8s.io - apiGroup: rbac.authorization.k8s.io
kind: User kind: User
name: kube-apiserver name: system:kube-apiserver
EOF EOF
``` ```
Reference: https://v1-12.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding Reference: https://v1-12.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding