{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/prometheus-operator/issues/357","repository_url":"https://api.github.com/repos/coreos/prometheus-operator","labels_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/357/labels{/name}","comments_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/357/comments","events_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/357/events","html_url":"https://github.com/coreos/prometheus-operator/issues/357","id":227263978,"number":357,"title":"RBAC on GKE - extra step needed","user":{"login":"gytisgreitai","id":1690228,"avatar_url":"https://avatars0.githubusercontent.com/u/1690228?v=4","gravatar_id":"","url":"https://api.github.com/users/gytisgreitai","html_url":"https://github.com/gytisgreitai","followers_url":"https://api.github.com/users/gytisgreitai/followers","following_url":"https://api.github.com/users/gytisgreitai/following{/other_user}","gists_url":"https://api.github.com/users/gytisgreitai/gists{/gist_id}","starred_url":"https://api.github.com/users/gytisgreitai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gytisgreitai/subscriptions","organizations_url":"https://api.github.com/users/gytisgreitai/orgs","repos_url":"https://api.github.com/users/gytisgreitai/repos","events_url":"https://api.github.com/users/gytisgreitai/events{/privacy}","received_events_url":"https://api.github.com/users/gytisgreitai/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":22,"created_at":"2017-05-09T06:32:52Z","updated_at":"2018-03-05T09:38:42Z","closed_at":"2017-05-09T10:21:41Z","author_association":"CONTRIBUTOR","body":"**What did you do?**\r\n\r\n`hack/cluster-monitoring/deploy`\r\n\r\n**What did you expect to see?**\r\n\r\nNo errors\r\n\r\n**What did you see instead? Under which circumstances?**\r\n\r\n```\r\nnamespace \"monitoring\" created\r\nclusterrolebinding \"prometheus-operator\" configured\r\nserviceaccount \"prometheus-operator\" created\r\ndeployment \"prometheus-operator\" created\r\nError from server (Forbidden): error when creating \"manifests/prometheus-operator/prometheus-operator-cluster-role.yaml\": clusterroles.rbac.authorization.k8s.io \"prometheus-operator\" is forbidden: attempt to grant extra privileges: [{[create] [extensions] [thirdpartyresources] [] []} {[*] [monitoring.coreos.com] [alertmanagers] [] []} {[*] [monitoring.coreos.com] [prometheuses] [] []} {[*] [monitoring.coreos.com] [servicemonitors] [] []} {[*] [apps] [statefulsets] [] []} {[*] [] [configmaps] [] []} {[*] [] [secrets] [] []} {[list] [] [pods] [] []} {[delete] [] [pods] [] []} {[get] [] [services] [] []} {[create] [] [services] [] []} {[update] [] [services] [] []} {[get] [] [endpoints] [] []} {[create] [] [endpoints] [] []} {[update] [] [endpoints] [] []} {[list] [] [nodes] [] []} {[watch] [] [nodes] [] []}] user=&{gytis@tripcreator.com  [system:authenticated] map[]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /swaggerapi /swaggerapi/* /version]}] ruleResolutionErrors=[]\r\nWaiting for Operator to register third party objects...done!\r\ndaemonset \"node-exporter\" created\r\nservice \"node-exporter\" created\r\nclusterrolebinding \"kube-state-metrics\" configured\r\ndeployment \"kube-state-metrics\" created\r\nserviceaccount \"kube-state-metrics\" created\r\nservice \"kube-state-metrics\" created\r\nError from server (Forbidden): error when creating \"manifests/kube-state-metrics/kube-state-metrics-cluster-role.yaml\": clusterroles.rbac.authorization.k8s.io \"kube-state-metrics\" is forbidden: attempt to grant extra privileges: [{[list] [] [nodes] [] []} {[watch] [] [nodes] [] []} {[list] [] [pods] [] []} {[watch] [] [pods] [] []} {[list] [] [resourcequotas] [] []} {[watch] [] [resourcequotas] [] []} {[list] [extensions] [daemonsets] [] []} {[watch] [extensions] [daemonsets] [] []} {[list] [extensions] [deployments] [] []} {[watch] [extensions] [deployments] [] []} {[list] [extensions] [replicasets] [] []} {[watch] [extensions] [replicasets] [] []}] user=&{gytis@tripcreator.com  [system:authenticated] map[]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /swaggerapi /swaggerapi/* /version]}] ruleResolutionErrors=[]\r\nsecret \"grafana-credentials\" created\r\nsecret \"grafana-credentials\" configured\r\nconfigmap \"grafana-dashboards\" created\r\ndeployment \"grafana\" created\r\nservice \"grafana\" created\r\nclusterrolebinding \"prometheus\" configured\r\nconfigmap \"prometheus-k8s-rules\" created\r\nserviceaccount \"prometheus-k8s\" created\r\nservicemonitor \"alertmanager\" configured\r\nservicemonitor \"kube-apiserver\" configured\r\nservicemonitor \"k8s-apps-http\" configured\r\nservicemonitor \"kube-state-metrics\" configured\r\nservicemonitor \"kubelet\" configured\r\nservicemonitor \"node-exporter\" configured\r\nservicemonitor \"prometheus\" configured\r\nservice \"prometheus-k8s\" created\r\nprometheus \"k8s\" configured\r\nError from server (Forbidden): error when creating \"manifests/prometheus/prometheus-cluster-role.yaml\": clusterroles.rbac.authorization.k8s.io \"prometheus\" is forbidden: attempt to grant extra privileges: [{[get] [] [nodes] [] []} {[list] [] [nodes] [] []} {[watch] [] [nodes] [] []} {[get] [] [services] [] []} {[list] [] [services] [] []} {[watch] [] [services] [] []} {[get] [] [endpoints] [] []} {[list] [] [endpoints] [] []} {[watch] [] [endpoints] [] []} {[get] [] [pods] [] []} {[list] [] [pods] [] []} {[watch] [] [pods] [] []} {[get] [] [configmaps] [] []} {[get] [] [] [] [/metrics]}] user=&{gytis@tripcreator.com  [system:authenticated] map[]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /swaggerapi /swaggerapi/* /version]}] ruleResolutionErrors=[]\r\nsecret \"alertmanager-main\" created\r\nservice \"alertmanager-main\" created\r\nalertmanager \"main\" configured\r\n```\r\n\r\n**Environment**\r\n\r\n* Kubernetes version information:\r\n\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"6\", GitVersion:\"v1.6.2\", GitCommit:\"477efc3cbe6a7effca06bd1452fa356e2201e1ee\", GitTreeState:\"clean\", BuildDate:\"2017-04-19T20:33:11Z\", GoVersion:\"go1.7.5\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"6\", GitVersion:\"v1.6.2\", GitCommit:\"477efc3cbe6a7effca06bd1452fa356e2201e1ee\", GitTreeState:\"clean\", BuildDate:\"2017-04-19T20:22:08Z\", GoVersion:\"go1.7.5\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n* Kubernetes cluster kind: \r\n\r\n\tGKE\r\n\r\nAccording to Google Container Engine docs:\r\n\r\n> \r\n> Because of the way Container Engine checks permissions when you create a Role or ClusterRole, you must first create a RoleBinding that grants you all of the permissions included in the role you want to create.\r\n> \r\n> An example workaround is to create a RoleBinding that gives your Google identity a cluster-admin role before attempting to create additional Role or ClusterRole permissions.\r\n> \r\n> This is a known issue in the Beta release of Role-Based Access Control in Kubernetes and Container Engine version 1.6.\r\n> \r\n\r\n\r\nSo in order to proceed without error, cluster-admin role should be added to current executing user, eg:\r\n\r\n```kubectl create clusterrolebinding your-user-cluster-admin-binding --clusterrole=cluster-admin --user=your.google.cloud.email@example.org```\r\n\r\nCould this be added as a faq/hint etc. somewhere?\r\n\r\nThank you!"},"comment":{"url":"https://api.github.com/repos/coreos/prometheus-operator/issues/comments/370362030","html_url":"https://github.com/coreos/prometheus-operator/issues/357#issuecomment-370362030","issue_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/357","id":370362030,"user":{"login":"RobinUS2","id":1712500,"avatar_url":"https://avatars3.githubusercontent.com/u/1712500?v=4","gravatar_id":"","url":"https://api.github.com/users/RobinUS2","html_url":"https://github.com/RobinUS2","followers_url":"https://api.github.com/users/RobinUS2/followers","following_url":"https://api.github.com/users/RobinUS2/following{/other_user}","gists_url":"https://api.github.com/users/RobinUS2/gists{/gist_id}","starred_url":"https://api.github.com/users/RobinUS2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RobinUS2/subscriptions","organizations_url":"https://api.github.com/users/RobinUS2/orgs","repos_url":"https://api.github.com/users/RobinUS2/repos","events_url":"https://api.github.com/users/RobinUS2/events{/privacy}","received_events_url":"https://api.github.com/users/RobinUS2/received_events","type":"User","site_admin":false},"created_at":"2018-03-05T09:38:42Z","updated_at":"2018-03-05T09:38:42Z","author_association":"NONE","body":"@Blasterdick interesting, because in my case there was no principal ID number to be found and I tried the email and it did work. At least it's worth testing both in case you are not making progress. "}}
{"actor":{"display_login":"RobinUS2"}}