{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes-client/python/issues/519","repository_url":"https://api.github.com/repos/kubernetes-client/python","labels_url":"https://api.github.com/repos/kubernetes-client/python/issues/519/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes-client/python/issues/519/comments","events_url":"https://api.github.com/repos/kubernetes-client/python/issues/519/events","html_url":"https://github.com/kubernetes-client/python/issues/519","id":316763788,"node_id":"MDU6SXNzdWUzMTY3NjM3ODg=","number":519,"title":"403 forbidden when  i ran in_cluster_config.py in the pod","user":{"login":"wangshuaizs","id":21264093,"node_id":"MDQ6VXNlcjIxMjY0MDkz","avatar_url":"https://avatars2.githubusercontent.com/u/21264093?v=4","gravatar_id":"","url":"https://api.github.com/users/wangshuaizs","html_url":"https://github.com/wangshuaizs","followers_url":"https://api.github.com/users/wangshuaizs/followers","following_url":"https://api.github.com/users/wangshuaizs/following{/other_user}","gists_url":"https://api.github.com/users/wangshuaizs/gists{/gist_id}","starred_url":"https://api.github.com/users/wangshuaizs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wangshuaizs/subscriptions","organizations_url":"https://api.github.com/users/wangshuaizs/orgs","repos_url":"https://api.github.com/users/wangshuaizs/repos","events_url":"https://api.github.com/users/wangshuaizs/events{/privacy}","received_events_url":"https://api.github.com/users/wangshuaizs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-04-23T11:04:57Z","updated_at":"2018-11-16T12:13:56Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\n I want to run examples/ folder in a pod, but error message said \r\n\r\n> root@gpu-pod:/data# python in_cluster_config.py\r\nListing pods with their IPs:\r\nTraceback (most recent call last):\r\n  File \"in_cluster_config.py\", line 32, in <module>\r\n    main()\r\n  File \"in_cluster_config.py\", line 25, in main\r\n    ret = v1.list_pod_for_all_namespaces(watch=False)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/apis/core_v1_api.py\", line 13589, in list_pod_for_all_namespaces\r\n    (data) = self.list_pod_for_all_namespaces_with_http_info(**kwargs)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/apis/core_v1_api.py\", line 13686, in list_pod_for_all_namespaces_with_http_info\r\n    collection_formats=collection_formats)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/api_client.py\", line 321, in call_api\r\n    _return_http_data_only, collection_formats, _preload_content, _request_timeout)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/api_client.py\", line 155, in __call_api\r\n    _request_timeout=_request_timeout)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/api_client.py\", line 342, in request\r\n    headers=headers)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/rest.py\", line 231, in GET\r\n    query_params=query_params)\r\n  File \"/usr/local/lib/python2.7/dist-packages/kubernetes/client/rest.py\", line 222, in request\r\n    raise ApiException(http_resp=r)\r\nkubernetes.client.rest.ApiException: (403)\r\nReason: Forbidden\r\nHTTP response headers: HTTPHeaderDict({'Date': 'Mon, 23 Apr 2018 10:48:16 GMT', 'Content-Length': '243', 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff'})\r\nHTTP response body: {\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"pods is forbidden: User \\\"system:serviceaccount:citicai:default\\\" cannot list pods at the cluster scope\",\"reason\":\"Forbidden\",\"details\":{\"kind\":\"pods\"},\"code\":403}\r\n\r\nI think this was maybe caused by service accounts. I used default service account for this pod. How can I generate a service account that can be used for the in_cluster_config.py file? Or are there another way to run this file in a pod?\r\ntks!"},"comment":{"url":"https://api.github.com/repos/kubernetes-client/python/issues/comments/439375523","html_url":"https://github.com/kubernetes-client/python/issues/519#issuecomment-439375523","issue_url":"https://api.github.com/repos/kubernetes-client/python/issues/519","id":439375523,"node_id":"MDEyOklzc3VlQ29tbWVudDQzOTM3NTUyMw==","user":{"login":"jabir366","id":17222278,"node_id":"MDQ6VXNlcjE3MjIyMjc4","avatar_url":"https://avatars2.githubusercontent.com/u/17222278?v=4","gravatar_id":"","url":"https://api.github.com/users/jabir366","html_url":"https://github.com/jabir366","followers_url":"https://api.github.com/users/jabir366/followers","following_url":"https://api.github.com/users/jabir366/following{/other_user}","gists_url":"https://api.github.com/users/jabir366/gists{/gist_id}","starred_url":"https://api.github.com/users/jabir366/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jabir366/subscriptions","organizations_url":"https://api.github.com/users/jabir366/orgs","repos_url":"https://api.github.com/users/jabir366/repos","events_url":"https://api.github.com/users/jabir366/events{/privacy}","received_events_url":"https://api.github.com/users/jabir366/received_events","type":"User","site_admin":false},"created_at":"2018-11-16T12:13:56Z","updated_at":"2018-11-16T12:13:56Z","author_association":"NONE","body":"I also have the same issue\r\nI am getting the following error when i run the program\r\nhttps://github.com/kubernetes-client/python/blob/master/examples/remote_cluster.py with the token of an admin-user serviceAccount\r\n\r\n` Listing pods with their IPs:\r\n/home/jabir/.local/lib/python2.7/site-packages/urllib3/connectionpool.py:847: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings\r\n  InsecureRequestWarning)\r\nTraceback (most recent call last):\r\n  File \"prog1.py\", line 38, in <module>\r\n    main()\r\n  File \"prog1.py\", line 31, in main\r\n    ret = v1.list_pod_for_all_namespaces(watch=False)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/apis/core_v1_api.py\", line 13812, in list_pod_for_all_namespaces\r\n    (data) = self.list_pod_for_all_namespaces_with_http_info(**kwargs)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/apis/core_v1_api.py\", line 13909, in list_pod_for_all_namespaces_with_http_info\r\n    collection_formats=collection_formats)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/api_client.py\", line 321, in call_api\r\n    _return_http_data_only, collection_formats, _preload_content, _request_timeout)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/api_client.py\", line 155, in __call_api\r\n    _request_timeout=_request_timeout)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/api_client.py\", line 342, in request\r\n    headers=headers)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/rest.py\", line 231, in GET\r\n    query_params=query_params)\r\n  File \"/home/jabir/.local/lib/python2.7/site-packages/kubernetes/client/rest.py\", line 222, in request\r\n    raise ApiException(http_resp=r)\r\nkubernetes.client.rest.ApiException: (403)\r\nReason: Forbidden\r\nHTTP response headers: HTTPHeaderDict({'Date': 'Fri, 16 Nov 2018 12:00:58 GMT', 'Content-Length': '290', 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff'})\r\nHTTP response body: {\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"v1 \\\"pods\\\" is forbidden: User \\\"system:serviceaccount:default:default\\\" cannot get resource \\\"v1\\\" in API group \\\"\\\" at the cluster scope\",\"reason\":\"Forbidden\",\"details\":{\"name\":\"pods\",\"kind\":\"v1\"},\"code\":403}\r\n`\r\nwhen i curl into my apiserver i am getting a success\r\n\r\n` curl https://192.168.3.143:6443/api --header \"Authorization: Bearer $TOKEN\" --insecure \r\n{\r\n  \"kind\": \"APIVersions\",\r\n  \"versions\": [\r\n    \"v1\"\r\n  ],\r\n  \"serverAddressByClientCIDRs\": [\r\n    {\r\n      \"clientCIDR\": \"0.0.0.0/0\",\r\n      \"serverAddress\": \"192.168.3.143:6443\"\r\n    }\r\n  ]\r\n} `\r\n\r\ni already have a serviceaccount which is in kube-system namespace with the following defenition\r\n\r\n` apiVersion: v1\r\nkind: ServiceAccount\r\nmetadata:\r\n  name: admin-user\r\n  namespace:   kube-system\r\n---\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRoleBinding\r\nmetadata:\r\n  name: admin-user\r\nroleRef:\r\n  apiGroup: rbac.authorization.k8s.io\r\n  kind: ClusterRole\r\n  name: cluster-admin\r\nsubjects:\r\n- kind: ServiceAccount\r\n  name: admin-user\r\n  namespace: kube-system\r\n\r\n`\r\n\r\ni just tried to change the namespace into 'default' and did `kubectl apply -f `\r\nand tried to run my program again .but it didnt work\r\ndo we have any provisoion to specify the namespace from our pyhton program"}}
{"actor":{"display_login":"jabir366"}}