<p>I am setting up a pod using calico but it keeps on failing with some authorization error. By default following is the node cidr of my system:</p>
<pre class="lang-sh prettyprint-override"><code>[root@k8master-1 ~]# kubeadm config view | grep Subnet
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
</code></pre>
<p>I have set up the ippools using the following steps:</p>
<p><a href="https://docs.projectcalico.org/getting-started/kubernetes/flannel/flannel" rel="nofollow noreferrer">https://docs.projectcalico.org/getting-started/kubernetes/flannel/flannel</a></p>
<h3>IP Pool creation</h3>
<pre class="lang-yaml prettyprint-override"><code>- apiVersion: projectcalico.org/v3
  kind: IPPool
  metadata:
    name: rack-ip-pool 
  spec:
    blockSize: 26
    cidr: 10.244.1.0/24
    ipipMode: Never
    natOutgoing: true
    nodeSelector: all()
    vxlanMode: Never
</code></pre>
<h3>Ip Pool List</h3>
<pre class="lang-sh prettyprint-override"><code>[root@k8master-1 ~]# calicoctl get ippool -o wide
NAME          CIDR            NAT    IPIPMODE   VXLANMODE   DISABLED   SELECTOR   
rack-ip-pool   10.244.1.0/24   true   Never      Never       false      all()   
</code></pre>
Pod Yaml
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: testcalico
  labels:
    cracklerack: &quot;1&quot;
spec:
  serviceName: testcalico-svc
  selector:
    matchLabels:
      cracklerack: &quot;1&quot;
  template:
    metadata:
      labels:
        cracklerack: &quot;1&quot;
      annotations:
       cni.projectcalico.org/ipv4pools: &quot;[\&quot;rack-ip-pool\&quot;]&quot;
    spec:
      runtimeClassName: kata-containers
      containers:
      - name: testcalico
        image: cracklelinux:7
        ports:
        - containerPort: 80
        command: [/usr/sbin/init]
        securityContext:
          privileged: true
---
apiVersion: v1
kind: Service
metadata:
 name: testcalico-svc
spec:
 clusterIP: None
 selector:
   cracklerack: &quot;1&quot;
</code></pre>
<p>When I create a pod, it throws the following error:</p>
<h3>Error</h3>
<pre class="lang-sh prettyprint-override"><code> Warning  FailedCreatePodSandBox  112s  kubelet, k8worker-1  Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod network sandbox k8s_xxxxx-0_default_45357eab-bf40-4fe7-a470-da42c9668116_0(579e2c258154fcdc2e85df4a1e35264ea9550b0dd1c4384331abc471f552456d): connection is unauthorized: ipamconfigs.crd.projectcalico.org &quot;default&quot; is forbidden: User &quot;system:serviceaccount:kube-system:canal&quot; cannot get resource &quot;ipamconfigs&quot; in API group &quot;crd.projectcalico.org&quot; at the cluster scope
</code></pre>

drifter
<p>Looks like you have an RBAC issue where your pod cannot read the Kubernetes the <code>IPAMConfig</code> CRD.</p>
<p>I looked at the manifests from <a href="https://docs.projectcalico.org/manifests/canal.yaml" rel="nofollow noreferrer">https://docs.projectcalico.org/manifests/canal.yaml</a> and I see that it's missing <code>ipamconfigs</code> from a couple of the RBAC ClusterRoles. So you can go ahead and try to add them.</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: calico-kube-controllers
rules:
  # Nodes are watched to monitor for deletions.
  - apiGroups: [&quot;&quot;]
    resources:
      - nodes
    verbs:
      - watch
      - list
      - get
  # Pods are queried to check for existence.
  - apiGroups: [&quot;&quot;]
    resources:
      - pods
    verbs:
      - get
  # IPAM resources are manipulated when nodes are deleted.
  - apiGroups: [&quot;crd.projectcalico.org&quot;]
    resources:
      - ippools
    verbs:
      - list
  - apiGroups: [&quot;crd.projectcalico.org&quot;]
    resources:
      - blockaffinities
      - ipamblocks
      - ipamhandles
      - ipamconfigs 👈 add here
 ...
</code></pre>
<p>Then the other ClusterRole:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: calico-node
rules:
...
  # Calico monitors various CRDs for config.
  - apiGroups: [&quot;crd.projectcalico.org&quot;]
    resources:
      - globalfelixconfigs
      - felixconfigurations
      - bgppeers
      - globalbgpconfigs
      - bgpconfigurations
      - ippools
      - ipamblocks
      - ipamconfigs 👈 add here
      - globalnetworkpolicies
      - globalnetworksets
      - networkpolicies
      - networksets
      - clusterinformations
      - hostendpoints
      - blockaffinities
    verbs:
      - get
      - list
      - watch
  # Calico must create and update some CRDs on startup.
  - apiGroups: [&quot;crd.projectcalico.org&quot;]
    resources:
      - ippools
      - ipamconfigs 👈 just in case
      - felixconfigurations
      - clusterinformations
    verbs:
      - create
      - update
...

</code></pre>
<p>Then run:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl apply -f canal.yaml
</code></pre>
<p>After applying this, you might need to restart your cluster (needed on my minikube at least).</p>
