{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/helm/issues/3104","repository_url":"https://api.github.com/repos/kubernetes/helm","labels_url":"https://api.github.com/repos/kubernetes/helm/issues/3104/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/helm/issues/3104/comments","events_url":"https://api.github.com/repos/kubernetes/helm/issues/3104/events","html_url":"https://github.com/kubernetes/helm/issues/3104","id":271398914,"node_id":"MDU6SXNzdWUyNzEzOTg5MTQ=","number":3104,"title":"error upgrading connection: unable to upgrade connection: Forbidden (user=system:anonymous","user":{"login":"zzq392342084","id":12469232,"node_id":"MDQ6VXNlcjEyNDY5MjMy","avatar_url":"https://avatars2.githubusercontent.com/u/12469232?v=4","gravatar_id":"","url":"https://api.github.com/users/zzq392342084","html_url":"https://github.com/zzq392342084","followers_url":"https://api.github.com/users/zzq392342084/followers","following_url":"https://api.github.com/users/zzq392342084/following{/other_user}","gists_url":"https://api.github.com/users/zzq392342084/gists{/gist_id}","starred_url":"https://api.github.com/users/zzq392342084/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zzq392342084/subscriptions","organizations_url":"https://api.github.com/users/zzq392342084/orgs","repos_url":"https://api.github.com/users/zzq392342084/repos","events_url":"https://api.github.com/users/zzq392342084/events{/privacy}","received_events_url":"https://api.github.com/users/zzq392342084/received_events","type":"User","site_admin":false},"labels":[{"id":269212356,"node_id":"MDU6TGFiZWwyNjkyMTIzNTY=","url":"https://api.github.com/repos/kubernetes/helm/labels/question/support","name":"question/support","color":"cc317c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2017-11-06T08:52:45Z","updated_at":"2018-06-11T07:56:00Z","closed_at":null,"author_association":"NONE","body":"when I run \"helm install fabric8/fabric8-platform  \",it outputs:\r\nError: forwarding ports: error upgrading connection: unable to upgrade connection: Forbidden (user=system:anonymous, verb=create, resource=nodes, subresource=proxy)\r\n\r\nI have bind the role as below,but it does not work:\r\n_kubectl create serviceaccount --namespace kube-system tiller\r\nkubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller\r\nkubectl patch deploy --namespace kube-system tiller-deploy -p '{\"spec\":{\"template\":{\"spec\":{\"serviceAccount\":\"tiller\"}}}}'_\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/helm/issues/comments/396154929","html_url":"https://github.com/kubernetes/helm/issues/3104#issuecomment-396154929","issue_url":"https://api.github.com/repos/kubernetes/helm/issues/3104","id":396154929,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjE1NDkyOQ==","user":{"login":"markusdresch","id":6547119,"node_id":"MDQ6VXNlcjY1NDcxMTk=","avatar_url":"https://avatars1.githubusercontent.com/u/6547119?v=4","gravatar_id":"","url":"https://api.github.com/users/markusdresch","html_url":"https://github.com/markusdresch","followers_url":"https://api.github.com/users/markusdresch/followers","following_url":"https://api.github.com/users/markusdresch/following{/other_user}","gists_url":"https://api.github.com/users/markusdresch/gists{/gist_id}","starred_url":"https://api.github.com/users/markusdresch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markusdresch/subscriptions","organizations_url":"https://api.github.com/users/markusdresch/orgs","repos_url":"https://api.github.com/users/markusdresch/repos","events_url":"https://api.github.com/users/markusdresch/events{/privacy}","received_events_url":"https://api.github.com/users/markusdresch/received_events","type":"User","site_admin":false},"created_at":"2018-06-11T07:56:00Z","updated_at":"2018-06-11T07:56:00Z","author_association":"NONE","body":"i managed to create a workaround by applying this yaml:\r\n\r\n```\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRole\r\nmetadata:\r\n  name: anonymous-logs-role\r\nrules:\r\n- apiGroups: [\"\"]\r\n  resources: [\"nodes/proxy\"]\r\n  verbs: [\"create\", \"get\"]\r\n---\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRoleBinding\r\nmetadata:\r\n  name: anonymous-logs-binding\r\nroleRef:\r\n  apiGroup: rbac.authorization.k8s.io\r\n  kind: ClusterRole\r\n  name: anonymous-logs-role\r\nsubjects:\r\n- apiGroup: rbac.authorization.k8s.io\r\n  kind: User\r\n  name: system:anonymous\r\n```\r\n\r\nthis way logs, exec and attach work and the api server doesn't expose any information. are there any drawbacks to this solution?"}}
{"actor":{"display_login":"markusdresch"}}