rbac-a | Role Based Access Control with Attributes and dynamic | Authorization library

Upon deploying a service with Spring Cloud Kubernetes Discovery Client, I get the KubernetesClientException stating that the user "default" is forbidden to access pods.

I have already added a Role and a Rolebinding as specified here

The guide states that a ClusterRole is necessary. But that is not an option for me, as we share the cluster with other departments. I only want the role to affect our project / namespace.

Is ClusterRole required or should Role be sufficient?

I followed the tutorial given here : https://auth0.com/blog/role-based-access-control-rbac-and-react-apps/ and it works all fine on localhost. After deployment on a VPS (with Apache2), the callback url doesn't work anymore I get a 404 not found page from the server when I land on http://domainename/callback after authentication. I have taken care of changing the callback url when deploying both in the app and among the authorized callback url from auth0.

I have tried to use an # in the domaine name : http://domainame.com/#/callback but it doesn't work. I have two questions : how to make it works and why does it work on localhost:3000 and not on domainname.com...

I have two kubernetes clusters that were set up by kops. They are both running v1.10.8. I have done by best to mirror the configuration between the two. They both have RBAC enabled. I have kubernetes-dashboard running on both. They both have a /srv/kubernetes/known_tokens.csv with an admin and a kube user:

$ sudo cat /srv/kubernetes/known_tokens.csv ABCD,admin,admin,system:masters DEFG,kube,kube (... other users ...)

My question is how do these users get authorized with consideration to RBAC? When authenticating to kubernetes-dashboard using tokens, the admin user's token works on both clusters and has full access. But the kube user's token only has access on one of the clusters. On one cluster, I get the following errors in the dashboard.

configmaps is forbidden: User "kube" cannot list configmaps in the namespace "default" persistentvolumeclaims is forbidden: User "kube" cannot list persistentvolumeclaims in the namespace "default" secrets is forbidden: User "kube" cannot list secrets in the namespace "default" services is forbidden: User "kube" cannot list services in the namespace "default" ingresses.extensions is forbidden: User "kube" cannot list ingresses.extensions in the namespace "default" daemonsets.apps is forbidden: User "kube" cannot list daemonsets.apps in the namespace "default" pods is forbidden: User "kube" cannot list pods in the namespace "default" events is forbidden: User "kube" cannot list events in the namespace "default" deployments.apps is forbidden: User "kube" cannot list deployments.apps in the namespace "default" replicasets.apps is forbidden: User "kube" cannot list replicasets.apps in the namespace "default" jobs.batch is forbidden: User "kube" cannot list jobs.batch in the namespace "default" cronjobs.batch is forbidden: User "kube" cannot list cronjobs.batch in the namespace "default" replicationcontrollers is forbidden: User "kube" cannot list replicationcontrollers in the namespace "default" statefulsets.apps is forbidden: User "kube" cannot list statefulsets.apps in the namespace "default"

As per the official docs, "Kubernetes does not have objects which represent normal user accounts".

I can't find anywhere on the working cluster that would give authorization to kube. Likewise, I can't find anything that would restrict kube on the other cluster. I've checked all ClusterRoleBinding resources in the default and kube-system namespace. None of these reference the kube user. So why the discrepancy in access to the dashboard and how can I adjust it?

Some other questions:

• How do I debug authorization issues such as this? The dashboard logs just say this user doesn't have access. Is there somewhere I can see which serviceAccount a particular request or token is mapped to?
• What are groups in k8s? The k8s docs mention groups a lot. Even the static token users can be assigned a group such as system:masters which looks like arole/clusterrolebut there is nosystem:mastersrole in my cluster? What exactly aregroups`? As per Create user group using RBAC API?, it appears groups are simply arbitrary labels that can be defined per user. What's the point of them? Can I map a group to a RBAC serviceAccount?

Update

I restarted the working cluster and it no longer works. I get the same authorization errors as the working cluster. Looks like it was some sort of cached access. Sorry for the bogus question. I'm still curious on my follow-up questions but they can be made into separate questions.

From this post in docker forum

https://forums.docker.com/t/enable-rbac-authorization-k8s-io-for-kube-apiserver/45793

it seems that so far (may 2018) that it's not possible to use K8S'RBAC in Docker 2.0 EE UCP.

Some of you found the same limitation? Was able to enable it?

I provisioned a managed GKE cluster (Kubernetes version 1.9.4-gke.1) with basic authentication disabled. When i try to create RBAC configuration (for running my ingress controller) I get a following error: Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "XXX@gmail.com" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.

I found two related questions:

1. GKE clusterrolebinding for cluster-admin fails with permission error
2. User "xxx" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope

First one contains a solution when basic authentication is enabled for the cluster which is not my case. And second question does not have an answer.

My user is not owner of the GCP project but it has editor role in the project. I found that this behavior was observed by others.

Please, advise how can I add the missing permission or otherwise defined RBAC on the GKE cluster when the cluster has basic authentication disabled.

I am creating a autorization token in puppet to setup code manager config in puppet master. On executing command and on putting login user and password "puppet-access login --service-url https://10.20.1.4:4433/rbac-api --lifetime 365" I got the error below

"Unable to reach the RBAC server at https://10.20.1.4:4433/rbac-api/v1/auth/token due to the following error: SSL peer certificate or SSH remote key was not OK."

could any one please help on it.

Thanks