{"action":"created","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/5854","repository_url":"https://api.github.com/repos/rancher/rancher","labels_url":"https://api.github.com/repos/rancher/rancher/issues/5854/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/5854/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/5854/events","html_url":"https://github.com/rancher/rancher/issues/5854","id":174235982,"number":5854,"title":"Container not able to access Kubernetes API when access control is enabled (Github)","user":{"login":"qamalbcgdv","id":17890957,"avatar_url":"https://avatars.githubusercontent.com/u/17890957?v=3","gravatar_id":"","url":"https://api.github.com/users/qamalbcgdv","html_url":"https://github.com/qamalbcgdv","followers_url":"https://api.github.com/users/qamalbcgdv/followers","following_url":"https://api.github.com/users/qamalbcgdv/following{/other_user}","gists_url":"https://api.github.com/users/qamalbcgdv/gists{/gist_id}","starred_url":"https://api.github.com/users/qamalbcgdv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qamalbcgdv/subscriptions","organizations_url":"https://api.github.com/users/qamalbcgdv/orgs","repos_url":"https://api.github.com/users/qamalbcgdv/repos","events_url":"https://api.github.com/users/qamalbcgdv/events{/privacy}","received_events_url":"https://api.github.com/users/qamalbcgdv/received_events","type":"User","site_admin":false},"labels":[{"id":256070545,"url":"https://api.github.com/repos/rancher/rancher/labels/area/kubernetes","name":"area/kubernetes","color":"fbca04","default":false},{"id":189155453,"url":"https://api.github.com/repos/rancher/rancher/labels/status/reopened","name":"status/reopened","color":"C80408","default":false},{"id":203009589,"url":"https://api.github.com/repos/rancher/rancher/labels/status/to-test","name":"status/to-test","color":"66aa66","default":false}],"state":"closed","locked":false,"assignee":{"login":"wlan0","id":1050521,"avatar_url":"https://avatars.githubusercontent.com/u/1050521?v=3","gravatar_id":"","url":"https://api.github.com/users/wlan0","html_url":"https://github.com/wlan0","followers_url":"https://api.github.com/users/wlan0/followers","following_url":"https://api.github.com/users/wlan0/following{/other_user}","gists_url":"https://api.github.com/users/wlan0/gists{/gist_id}","starred_url":"https://api.github.com/users/wlan0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wlan0/subscriptions","organizations_url":"https://api.github.com/users/wlan0/orgs","repos_url":"https://api.github.com/users/wlan0/repos","events_url":"https://api.github.com/users/wlan0/events{/privacy}","received_events_url":"https://api.github.com/users/wlan0/received_events","type":"User","site_admin":false},"assignees":[{"login":"wlan0","id":1050521,"avatar_url":"https://avatars.githubusercontent.com/u/1050521?v=3","gravatar_id":"","url":"https://api.github.com/users/wlan0","html_url":"https://github.com/wlan0","followers_url":"https://api.github.com/users/wlan0/followers","following_url":"https://api.github.com/users/wlan0/following{/other_user}","gists_url":"https://api.github.com/users/wlan0/gists{/gist_id}","starred_url":"https://api.github.com/users/wlan0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wlan0/subscriptions","organizations_url":"https://api.github.com/users/wlan0/orgs","repos_url":"https://api.github.com/users/wlan0/repos","events_url":"https://api.github.com/users/wlan0/events{/privacy}","received_events_url":"https://api.github.com/users/wlan0/received_events","type":"User","site_admin":false},{"login":"galal-hussein","id":3309968,"avatar_url":"https://avatars.githubusercontent.com/u/3309968?v=3","gravatar_id":"","url":"https://api.github.com/users/galal-hussein","html_url":"https://github.com/galal-hussein","followers_url":"https://api.github.com/users/galal-hussein/followers","following_url":"https://api.github.com/users/galal-hussein/following{/other_user}","gists_url":"https://api.github.com/users/galal-hussein/gists{/gist_id}","starred_url":"https://api.github.com/users/galal-hussein/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/galal-hussein/subscriptions","organizations_url":"https://api.github.com/users/galal-hussein/orgs","repos_url":"https://api.github.com/users/galal-hussein/repos","events_url":"https://api.github.com/users/galal-hussein/events{/privacy}","received_events_url":"https://api.github.com/users/galal-hussein/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/rancher/rancher/milestones/81","html_url":"https://github.com/rancher/rancher/milestone/81","labels_url":"https://api.github.com/repos/rancher/rancher/milestones/81/labels","id":2169777,"number":81,"title":"Release 1.4.0","description":"","creator":{"login":"will-chan","id":10134676,"avatar_url":"https://avatars.githubusercontent.com/u/10134676?v=3","gravatar_id":"","url":"https://api.github.com/users/will-chan","html_url":"https://github.com/will-chan","followers_url":"https://api.github.com/users/will-chan/followers","following_url":"https://api.github.com/users/will-chan/following{/other_user}","gists_url":"https://api.github.com/users/will-chan/gists{/gist_id}","starred_url":"https://api.github.com/users/will-chan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/will-chan/subscriptions","organizations_url":"https://api.github.com/users/will-chan/orgs","repos_url":"https://api.github.com/users/will-chan/repos","events_url":"https://api.github.com/users/will-chan/events{/privacy}","received_events_url":"https://api.github.com/users/will-chan/received_events","type":"User","site_admin":false},"open_issues":101,"closed_issues":6,"state":"open","created_at":"2016-12-01T20:08:28Z","updated_at":"2016-12-22T22:22:48Z","due_on":"2017-01-31T08:00:00Z","closed_at":null},"comments":5,"created_at":"2016-08-31T10:15:51Z","updated_at":"2016-12-22T22:22:48Z","closed_at":"2016-12-22T22:22:48Z","body":"**Rancher Version:** 1.1.2\n\n**Docker Version:** 1.11.2\n\n**OS and where are the hosts located? (cloud, bare metal, etc):** Ubuntu Xenial @ AWS\n\n**Setup Details: (single node rancher vs. HA rancher, internal DB vs. external DB)** HA Rancher, external DB\n\n**Environment Type: (Cattle/Kubernetes/Swarm/Mesos)** Kubernetes\n\n**Steps to Reproduce:**\n- Enable access control with Github\n- Create a Kubernetes environment\n- Create a pod with curl access from inside container\n- Create a service account (or use the default)\n- Hit the kubernetes API endpoint (e.g: https://rancher.example.org/r/projects/1a2/kubernetes/api)\n\n**Results:** \n- You get an error because you are not logged in to github\n\n**Expected:**\n- You should be able to hit the API with a service account\n\nI have a use case where I am using the Fluentd forwarder to aggregate the container logs. The Fluentd Kubernetes plugin requires access to the Kubernetes API in order to fetch metadata associated with the logs. When disabling access control this works fine and the container is able to fetch metadata from the Kubernetes API using the provisioned service account.\n"},"comment":{"url":"https://api.github.com/repos/rancher/rancher/issues/comments/268903907","html_url":"https://github.com/rancher/rancher/issues/5854#issuecomment-268903907","issue_url":"https://api.github.com/repos/rancher/rancher/issues/5854","id":268903907,"user":{"login":"galal-hussein","id":3309968,"avatar_url":"https://avatars.githubusercontent.com/u/3309968?v=3","gravatar_id":"","url":"https://api.github.com/users/galal-hussein","html_url":"https://github.com/galal-hussein","followers_url":"https://api.github.com/users/galal-hussein/followers","following_url":"https://api.github.com/users/galal-hussein/following{/other_user}","gists_url":"https://api.github.com/users/galal-hussein/gists{/gist_id}","starred_url":"https://api.github.com/users/galal-hussein/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/galal-hussein/subscriptions","organizations_url":"https://api.github.com/users/galal-hussein/orgs","repos_url":"https://api.github.com/users/galal-hussein/repos","events_url":"https://api.github.com/users/galal-hussein/events{/privacy}","received_events_url":"https://api.github.com/users/galal-hussein/received_events","type":"User","site_admin":false},"created_at":"2016-12-22T22:22:48Z","updated_at":"2016-12-22T22:22:48Z","body":"Rancher version: master build\r\nkubernetes: rancher/k8s:v1.5.1-rancher1-2\r\n\r\nI was able to authenticate with a custom service account even with Github authentication is enabled, i wasn't able to authenticate with the default service account at first which appears to be a kubernetes problem:\r\n\r\nhttps://github.com/kubernetes/kubernetes/issues/22351\r\n\r\nAnd by following the workaround (deleting the invalidated secret for the default account) that is mentioned in the bug above solved the problem."}}
{"actor":{"display_login":"galal-hussein"}}