Authorization

[Wouter053]

Hi,

In Kubernetes 1.24 tokens are not created for service accounts. So the authorization procedure in the documentation no longer works:

To create a Service Account for a user "example" in the "default" namespace, run the following:
kubectl create -n default serviceaccount example
To get the API token for this Service Account, run the following:
kubectl get -n default secret $(kubectl get -n default serviceaccount example -o jsonpath='{.secrets[].name}') -o go-template='{{.data.token | base64decode}}' && echo

So I created service account "example" like above, and then created a token with
kubectl create -f token.yml

token.yml:

apiVersion: v1
kind: Secret`
metadata:`
   namespace: default` 
   name: example-secret`
   annotations:`
       kubernetes.io/service-account.name: "example"`
type: kubernetes.io/service-account-token`

I then apply this yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: example
  namespace: default

I can now see the token with
kubectl describe secret example-secret

However, this token does not get me into the kubeapps dashboard. It does get me into the standard kubernetes dasboard

Any ideas?

[antgamdia]

Thanks for pointing this out! Even if Kubeapps officially does not support k8s 1.24 yet (our policy is to actively support those versions in here) we are aware of this change in k8s and we have already planned to analyze the impact.

I'll try to repro the issue in a local 1.24 k8s cluster and I'll get back to you!
Anyway, in the meanwhile, do you think it can be related to an RBAC issue? Did you create the clusterrolebinding for that SA?

[Wouter053]

Yes, I created a ClusterRoleBinding. See my post, I applied a yaml to create it. That part has worked.

[Wouter053]

I did notice something:

kubectl get deployments
NAME                                                    READY   UP-TO-DATE   AVAILABLE   AGE
kubeapps-1652854940                                     2/2     2            2           2d2h
kubeapps-1652854940-internal-apprepository-controller   1/1     1            1           2d2h
kubeapps-1652854940-internal-dashboard                  2/2     2            2           2d2h
kubeapps-1652854940-internal-kubeappsapis               2/2     2            2           2d2h
kubeapps-1652854940-internal-kubeops                    2/2     2            2           2d2h

Of these deployments all have pods running except kubeapps-1652854940

[absoludity]

Hi @Wouter053 . I just tested this out and seemed to work fine for me, doing something similar to what you'd done above. Can you check the instructions that I've included in the update at #4772 please? Though I think it's the same/similar to what you tried, it worked fine for me in both 1.24 and 1.21, so I suspect something else on your cluster. Let me know how you go after you try the updated instructions in that PR please. Thanks!

[Wouter053]

Hi @absoludity, in the end I just threw away the entire cluster because I noticed some other hickups. Built a new one, installed kubeapps, running smoothly now. Logged in without a problem. Thanks for the help.