Skip to content

Fix misc RBAC issues on 1.6.6#477

Merged
andraxylia merged 1 commit intomasterfrom
rbac
Jul 18, 2017
Merged

Fix misc RBAC issues on 1.6.6#477
andraxylia merged 1 commit intomasterfrom
rbac

Conversation

@andraxylia
Copy link
Copy Markdown
Contributor

@andraxylia andraxylia commented Jul 18, 2017

I upgraded to a k8s 1.6.6 cluster and pilot can no longer read TPRs.

I0718 23:23:06.618825 1 client.go:194] TPR "IstioConfig" is not ready (User "system:serviceaccount:istio-test-nb5kb:istio-pilot-service-account" cannot list istioconfigs.istio.io at the cluster scope.: "Unknown user "system:serviceaccount:istio-test-nb5kb:istio-pilot-service-account"" (get IstioConfigs.istio.io)). Waiting...

Fixed also Ingress status, who was no longer updated after adding the k8s Syncer, because we were missing list permissions on the nodes.

This version is now in sync with the e2e tests in pilot, that can be run independently on an RBAC enabled cluster.

@andraxylia andraxylia requested a review from costinm July 18, 2017 22:00
@ldemailly
Copy link
Copy Markdown
Member

ldemailly commented Jul 18, 2017

Any way to get a test for this (failing without the fix and passing with it) ?

Also can you describe a bit the fix/symptoms etc by editing the PR description (if we want to put this in the stable release-0.1 branch we need to be extra descriptive with the changes)

@istio-testing
Copy link
Copy Markdown
Collaborator

Jenkins job istio/presubmit passed

Copy link
Copy Markdown
Contributor

@costinm costinm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems in 1.6.6 ClusterRoleBinding works - and RoleBinding no longer works. The error message (user not found) doesn't make sense either.

So +1 to fix the tests - we don't officially document running in a namespace.

@andraxylia andraxylia merged commit 98fafa6 into master Jul 18, 2017
@andraxylia
Copy link
Copy Markdown
Contributor Author

Create a cluster in GKE with 1.6.6 version and deploy istio, then do kubectl logs pilot-... , kubectl logs ingress-....

@andraxylia andraxylia deleted the rbac branch July 18, 2017 23:50
lachie83 added a commit to lachie83/istio that referenced this pull request Jul 19, 2017
…lachie83/istio into bugfix-resync-alpha-beta-rbac-manifests

* 'bugfix-resync-alpha-beta-rbac-manifests' of github.com:lachie83/istio:
  Fix misc RBAC issues on 1.6.6 (istio#477)
rshriram pushed a commit that referenced this pull request Oct 30, 2017
mandarjog pushed a commit that referenced this pull request Nov 2, 2017
guptasu pushed a commit to guptasu/istio that referenced this pull request Jun 11, 2018
Also, fix python generation logic to stop passing directory names as proto files.
This eliminates a bunch of warnings when building the repo, and eliminates a bunch
of broken dud checked in files.
kyessenov pushed a commit to kyessenov/istio that referenced this pull request Aug 13, 2018
* update envoy sha

adding regex match support in routes

* no more filter types

* more nixing

* interactive compilation with Jenkins

* hopefully the last compilation fix

* one more

* one more

* another one
howardjohn pushed a commit to howardjohn/istio that referenced this pull request Jan 12, 2020
howardjohn pushed a commit to howardjohn/istio that referenced this pull request Jan 12, 2020
* WIP: Refine e2e implementation

This is a refinement based upon the prior PRs in this area.

Depends-On: istio/tools#483

* Use proper image with jq
luksa added a commit to luksa/istio that referenced this pull request Sep 20, 2022
antonioberben pushed a commit to antonioberben/istio that referenced this pull request Jan 29, 2024
[jaeger] Add option to configure ingester only via environment variables
fjglira pushed a commit to fjglira/istio that referenced this pull request Sep 26, 2025
…ter-merge_upstream_istio_master-6253864e

Automator: merge upstream changes to openshift-service-mesh/istio@master
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants