{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/38165","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/38165/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/38165/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/38165/events","html_url":"https://github.com/kubernetes/kubernetes/issues/38165","id":193663094,"number":38165,"title":"The cfssl container run in hack/local-up-cluster.sh gets permissions errors","user":{"login":"jeffvance","id":3076896,"avatar_url":"https://avatars.githubusercontent.com/u/3076896?v=3","gravatar_id":"","url":"https://api.github.com/users/jeffvance","html_url":"https://github.com/jeffvance","followers_url":"https://api.github.com/users/jeffvance/followers","following_url":"https://api.github.com/users/jeffvance/following{/other_user}","gists_url":"https://api.github.com/users/jeffvance/gists{/gist_id}","starred_url":"https://api.github.com/users/jeffvance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeffvance/subscriptions","organizations_url":"https://api.github.com/users/jeffvance/orgs","repos_url":"https://api.github.com/users/jeffvance/repos","events_url":"https://api.github.com/users/jeffvance/events{/privacy}","received_events_url":"https://api.github.com/users/jeffvance/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-06T02:00:22Z","updated_at":"2016-12-06T16:59:52Z","closed_at":null,"body":"Get various config errors after rebasing to latest k8s and running `local-up-cluster.sh`:\r\n```\r\nFailed to load config file: {\"code\":5200,\"message\":\"could not read configuration file\"}Failed to parse input: unexpected end of JSON input\r\nmv: cannot stat '/var/run/kubernetes/client-kubelet-key.pem': No such file or directory\r\nFailed to load config file: {\"code\":5200,\"message\":\"could not read configuration file\"}Failed to parse input: unexpected end of JSON input\r\nmv: cannot stat '/var/run/kubernetes/client-kube-proxy-key.pem': No such file or directory\r\nFailed to load config file: {\"code\":5200,\"message\":\"could not read configuration file\"}Failed to parse input: unexpected end of JSON input\r\nmv: cannot stat '/var/run/kubernetes/client-controller-key.pem': No such file or directory\r\nFailed to load config file: {\"code\":5200,\"message\":\"could not read configuration file\"}Failed to parse input: unexpected end of JSON input\r\nmv: cannot stat '/var/run/kubernetes/client-scheduler-key.pem': No such file or directory\r\n```\r\nwith the end result being that `kubectl get nodes` shows no resources.\r\n\r\nVersion:\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"4\", GitVersion:\"v1.4.0+776c994\",\r\nGitCommit:\"776c994\", GitTreeState:\"clean\", BuildDate:\"2016-11-03T21:47:56Z\",\r\nGoVersion:\"go1.6.1\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"6+\",\r\nGitVersion:\"v1.6.0-alpha.0.1439+608df651db3545-dirty\",\r\nGitCommit:\"608df651db3545b1171f424fa52e245a1449c807\", GitTreeState:\"dirty\",\r\nBuildDate:\"2016-12-05T21:20:10Z\", GoVersion:\"go1.6.1\", Compiler:\"gc\",\r\nPlatform:\"linux/amd64\"}\r\n```\r\n\r\n`hack/local-up-cluster.sh` function create_client_certkey() runs the cfssl container bind-mounted to /var/run/kubernetes.  Shelling into this container you'll see there are no `owner:group` for the files in its /cert dirt (which is the host's /var/run/kubernetes dir):\r\n```\r\nroot@a5bfa7d640f9:/certs# ls -l    #pwd is /cert\r\nls: cannot access client-ca.crt: Permission denied\r\nls: cannot access client-ca.key: Permission denied\r\nls: cannot access auth-proxy-client-ca.crt: Permission denied\r\nls: cannot access auth-proxy-client-ca.key: Permission denied\r\nls: cannot access scheduler.kubeconfig: Permission denied\r\nls: cannot access controller.kubeconfig: Permission denied\r\nls: cannot access kube-proxy.kubeconfig: Permission denied\r\nls: cannot access kubelet.kubeconfig: Permission denied\r\nls: cannot access apiserver.key: Permission denied\r\nls: cannot access apiserver.crt: Permission denied\r\nls: cannot access client-ca-bundle.crt: Permission denied\r\nls: cannot access auth-proxy-client-ca-config.json: Permission denied\r\nls: cannot access client-ca-config.json: Permission denied\r\ntotal 0\r\n-????????? ? ? ? ?            ? apiserver.crt\r\n-????????? ? ? ? ?            ? apiserver.key\r\n-????????? ? ? ? ?            ? auth-proxy-client-ca-config.json\r\n-????????? ? ? ? ?            ? auth-proxy-client-ca.crt\r\n-????????? ? ? ? ?            ? auth-proxy-client-ca.key\r\n-????????? ? ? ? ?            ? client-ca-bundle.crt\r\n-????????? ? ? ? ?            ? client-ca-config.json\r\n-????????? ? ? ? ?            ? client-ca.crt\r\n-????????? ? ? ? ?            ? client-ca.key\r\n-????????? ? ? ? ?            ? controller.kubeconfig\r\n-????????? ? ? ? ?            ? kube-proxy.kubeconfig\r\n-????????? ? ? ? ?            ? kubelet.kubeconfig\r\n-????????? ? ? ? ?            ? scheduler.kubeconfig\r\nroot@a5bfa7d640f9:/certs# cat client-ca-config.json\r\ncat: client-ca-config.json: Permission denied\r\n```\r\nIf I run the cfssl container with `--privileged` it all works both when shelling in (root is owner and group), and `kubectl get nodes` works as expected.\r\n\r\nQ: is there something wrong with my local env on the latest kube? Or, should the cfssl container be run privileged now? Or is there a smaller hammer?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/265206356","html_url":"https://github.com/kubernetes/kubernetes/issues/38165#issuecomment-265206356","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/38165","id":265206356,"user":{"login":"jeffvance","id":3076896,"avatar_url":"https://avatars.githubusercontent.com/u/3076896?v=3","gravatar_id":"","url":"https://api.github.com/users/jeffvance","html_url":"https://github.com/jeffvance","followers_url":"https://api.github.com/users/jeffvance/followers","following_url":"https://api.github.com/users/jeffvance/following{/other_user}","gists_url":"https://api.github.com/users/jeffvance/gists{/gist_id}","starred_url":"https://api.github.com/users/jeffvance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeffvance/subscriptions","organizations_url":"https://api.github.com/users/jeffvance/orgs","repos_url":"https://api.github.com/users/jeffvance/repos","events_url":"https://api.github.com/users/jeffvance/events{/privacy}","received_events_url":"https://api.github.com/users/jeffvance/received_events","type":"User","site_admin":false},"created_at":"2016-12-06T16:59:52Z","updated_at":"2016-12-06T16:59:52Z","body":"Thanks @jsafrane. I'm running kube in rhel vms. However, the cfssl container is not fedora based is it?\r\nFrom cfssl container:\r\n```\r\n# uname -a\r\nLinux b0db5531b84c 3.10.0-327.4.5.el7.x86_64 #1 SMP Thu Jan 21 04:10:29 EST 2016 x86_64 GNU/Linux\r\nroot@b0db5531b84c:/certs# getenforce\r\nbash: getenforce: command not found\r\n```"}}
{"actor":{"display_login":"jeffvance"}}