<p>I try to run Prefect flow in IBM Cloud Kubernetes cluster. So I am setting up the Kubernetes Agent. I see errors when I do:</p>
<pre><code>kubectl apply -f prefect_agent.yaml

kubectl logs prefect-agent-778f997b7-hnsk2
[2021-12-07 12:34:14,399] INFO - agent | Registering agent...
Traceback (most recent call last):
  File &quot;/usr/local/bin/prefect&quot;, line 8, in &lt;module&gt;
    sys.exit(cli())
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 829, in __call__
    return self.main(*args, **kwargs)
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 782, in main
    rv = self.invoke(ctx)
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 1259, in invoke


    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 1259, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 1259, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File &quot;/usr/local/lib/python3.6/site-packages/click/core.py&quot;, line 610, in invoke
    return callback(*args, **kwargs)
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/cli/agent.py&quot;, line 331, in start
    start_agent(KubernetesAgent, image_pull_secrets=image_pull_secrets, **kwargs)
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/cli/agent.py&quot;, line 140, in start_agent
    agent.start()
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/agent/agent.py&quot;, line 189, in start
    self._setup_api_connection()
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/agent/agent.py&quot;, line 910, in _setup_api_connection
    self.client.attach_headers({&quot;X-PREFECT-AGENT-ID&quot;: self._register_agent()})
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/agent/agent.py&quot;, line 858, in _register_agent
    agent_config_id=self.agent_config_id,
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/client/client.py&quot;, line 2101, in register_agent
    tenant_id=self.tenant_id,
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/client/client.py&quot;, line 329, in tenant_id
    self._tenant_id = self._get_auth_tenant()
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/client/client.py&quot;, line 214, in _get_auth_tenant
    response = self.graphql({&quot;query&quot;: {&quot;auth_info&quot;: &quot;tenant_id&quot;}})
  File &quot;/usr/local/lib/python3.6/site-packages/prefect/client/client.py&quot;, line 561, in graphql
    raise AuthorizationError(result[&quot;errors&quot;])
prefect.exceptions.AuthorizationError: [{'path': ['auth_info'], 'message': 'AuthenticationError: Forbidden', 'extensions': {'code': 'UNAUTHENTICATED'}}]
</code></pre>
<p>Attach the prefect_agent.yaml</p>
<pre><code>---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: prefect-agent
  name: prefect-agent
spec:
  replicas: 1
  selector:
    matchLabels:
      app: prefect-agent
  template:
    metadata:
      labels:
        app: prefect-agent
    spec:
      containers:
      - args:
        - prefect agent kubernetes start
        command:
        - /bin/bash
        - -c
        env:
        - name: PREFECT__CLOUD__AGENT__AUTH_TOKEN
          value: ''
        - name: PREFECT__CLOUD__API
          value: https://api.prefect.io
        - name: NAMESPACE
          value: prefect
        - name: IMAGE_PULL_SECRETS
          value: ''
        - name: PREFECT__CLOUD__AGENT__LABELS
          value: '[&quot;k8s&quot;]'
        - name: JOB_MEM_REQUEST
          value: ''
        - name: JOB_MEM_LIMIT
          value: ''
        - name: JOB_CPU_REQUEST
          value: ''
        - name: JOB_CPU_LIMIT
          value: ''
        - name: IMAGE_PULL_POLICY
          value: ''
        - name: SERVICE_ACCOUNT_NAME
          value: ''
        - name: PREFECT__BACKEND
          value: cloud
        - name: PREFECT__CLOUD__AGENT__AGENT_ADDRESS
          value: http://:8080
        - name: PREFECT__CLOUD__API_KEY
          value: {myapikey}
        - name: PREFECT__CLOUD__TENANT_ID
          value: ''
        image: prefecthq/prefect:0.15.6-python3.6
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 2
          httpGet:
            path: /api/health
            port: 8080
          initialDelaySeconds: 40
          periodSeconds: 40
        name: agent
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: prefect-agent-rbac
  namespace: prefect
rules:
- apiGroups:
  - batch
  - extensions
  resources:
  - jobs
  verbs:
  - '*'
- apiGroups:
  - ''
  resources:
  - events
  - pods
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: prefect-agent-rbac
  namespace: prefect
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: prefect-agent-rbac
subjects:
- kind: ServiceAccount
  name: default
</code></pre>
<p>I can see the roles and rolebindings are created:</p>
<pre><code>(venv) xxxtorage % kubectl get roles
NAME                 CREATED AT
prefect-agent-rbac   2021-12-07T12:34:57Z
(venv) xxxtorage % kubectl get rolebindings
NAME                 ROLE                      AGE
prefect-agent-rbac   Role/prefect-agent-rbac   22m
</code></pre>
<p>Before running commands, I have sent the default namespace to &quot;prefect&quot;. I created the &quot;prefect&quot; namespace to organize all the Prefect related resources.</p>

Zheng Xie
<p>I found that the <code>- name: PREFECT__CLOUD__API_KEY value: {myapikey}</code>
this is generated by: <a href="https://docs.prefect.io/orchestration/concepts/api.html#authentication" rel="nofollow noreferrer">https://docs.prefect.io/orchestration/concepts/api.html#authentication</a></p>
<p>I used the Kubernetes cluster API key. Thus the error.</p>
