{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/contrib/issues/1504","repository_url":"https://api.github.com/repos/kubernetes/contrib","labels_url":"https://api.github.com/repos/kubernetes/contrib/issues/1504/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/contrib/issues/1504/comments","events_url":"https://api.github.com/repos/kubernetes/contrib/issues/1504/events","html_url":"https://github.com/kubernetes/contrib/issues/1504","id":170458446,"number":1504,"title":"nginx-ingress-controller: the server does not allow access to the requested resource","user":{"login":"lendico-dmitry-dzifuta","id":13364139,"avatar_url":"https://avatars.githubusercontent.com/u/13364139?v=3","gravatar_id":"","url":"https://api.github.com/users/lendico-dmitry-dzifuta","html_url":"https://github.com/lendico-dmitry-dzifuta","followers_url":"https://api.github.com/users/lendico-dmitry-dzifuta/followers","following_url":"https://api.github.com/users/lendico-dmitry-dzifuta/following{/other_user}","gists_url":"https://api.github.com/users/lendico-dmitry-dzifuta/gists{/gist_id}","starred_url":"https://api.github.com/users/lendico-dmitry-dzifuta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lendico-dmitry-dzifuta/subscriptions","organizations_url":"https://api.github.com/users/lendico-dmitry-dzifuta/orgs","repos_url":"https://api.github.com/users/lendico-dmitry-dzifuta/repos","events_url":"https://api.github.com/users/lendico-dmitry-dzifuta/events{/privacy}","received_events_url":"https://api.github.com/users/lendico-dmitry-dzifuta/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-10T16:19:00Z","updated_at":"2016-08-11T09:59:35Z","closed_at":null,"body":"I'm trying to run nginx-ingress-controller from rc-default.yaml. Doing it asis causes the following error:\r\n`I0810 15:56:28.267295       1 main.go:99] Using build: https://github.com/bprashanth/contrib.git - git-b195d9b F0810 15:56:28.353709       1 main.go:128] unexpected error getting runtime information: the server does not allow access to the requested resource (get nodes xxx)`\r\n\r\nEnvironment is kubernetes cluster. Default service account has necessary permissions, so API should be accessible.\r\n\r\n Any ideas why this happens?"},"comment":{"url":"https://api.github.com/repos/kubernetes/contrib/issues/comments/239119577","html_url":"https://github.com/kubernetes/contrib/issues/1504#issuecomment-239119577","issue_url":"https://api.github.com/repos/kubernetes/contrib/issues/1504","id":239119577,"user":{"login":"lendico-dmitry-dzifuta","id":13364139,"avatar_url":"https://avatars.githubusercontent.com/u/13364139?v=3","gravatar_id":"","url":"https://api.github.com/users/lendico-dmitry-dzifuta","html_url":"https://github.com/lendico-dmitry-dzifuta","followers_url":"https://api.github.com/users/lendico-dmitry-dzifuta/followers","following_url":"https://api.github.com/users/lendico-dmitry-dzifuta/following{/other_user}","gists_url":"https://api.github.com/users/lendico-dmitry-dzifuta/gists{/gist_id}","starred_url":"https://api.github.com/users/lendico-dmitry-dzifuta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lendico-dmitry-dzifuta/subscriptions","organizations_url":"https://api.github.com/users/lendico-dmitry-dzifuta/orgs","repos_url":"https://api.github.com/users/lendico-dmitry-dzifuta/repos","events_url":"https://api.github.com/users/lendico-dmitry-dzifuta/events{/privacy}","received_events_url":"https://api.github.com/users/lendico-dmitry-dzifuta/received_events","type":"User","site_admin":false},"created_at":"2016-08-11T09:59:35Z","updated_at":"2016-08-11T09:59:35Z","body":"@aledbf my investigation showed the following - api server was rejecting (with forbidden) GET request to node resource. I'm using ABAC authorisation mode with the following line for the service account:\r\n{\"apiVersion\": \"abac.authorization.kubernetes.io/v1beta1\", \"kind\": \"Policy\", \"spec\": {\"user\": \"system:serviceaccount:dev:default\",         \"namespace\": \"dev\",           \"resource\": \"*\",          \"apiGroup\": \"*\"}}\r\n\r\nChange of the namespace dev --> * resolved the issue. Would be helpful to know the reason of this behaviour. Plus this violates namespace isolation. It would be also useful to have more logging in case of rejection - right now it's just forbidden statement, which is not helpful.\r\n\r\nI probably should move the issue to different repo now."}}
{"actor":{"display_login":"lendico-dmitry-dzifuta"}}