plusserver/k8s-ipam-configmap

IP Address management using a Kubernetes ConfigMap

k8s-ipam-configmap's Issues

configmaps is forbidden: User "system:serviceaccount:kube-system:k8s-ipam-configmap" cannot create configmaps in the namespace "kube-system"

Hi,

first of all, thanks for opensourcing fortigate-lb-ctlr, great stuff.

I am trying to deploy fortigate-lb-ctlr with k8s-ipam-configmap and I ran into an issue.

After applying the various YAML files, including rbac.yml, the k8s-ipam-configmap container fails to start:

panic: error creating initial address management configmap 'ipam-cm' in namespace 'kube-system': configmaps is forbidden: User "system:serviceaccount:kube-system:k8s-ipam-configmap" cannot create configmaps in the namespace "kube-system"

$ kubectl get serviceaccount k8s-ipam-configmap -o yaml --namespace=kube-system
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{},"name":"k8s-ipam-configmap","namespace":"kube-system"}}
  creationTimestamp: 2018-10-14T21:26:38Z
  name: k8s-ipam-configmap
  namespace: kube-system
  resourceVersion: "246525"
  selfLink: /api/v1/namespaces/kube-system/serviceaccounts/k8s-ipam-configmap
  uid: d5a14d10-cff7-11e8-b1c4-005056b43773
secrets:
- name: k8s-ipam-configmap-token-cmc5j

$ kubectl get clusterroles k8s-ipam-configmap -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"name":"k8s-ipam-configmap","namespace":""},"rules":[{"apiGroups":[""],"resourceNames":["ipam-cm"],"resources":["configmaps"],"verbs":["create","get","update","patch","delete"]},{"apiGroups":["ipam.nexinto.com"],"resources":["ipaddresses"],"verbs":["*"]}]}
  creationTimestamp: 2018-10-14T12:40:08Z
  name: k8s-ipam-configmap
  resourceVersion: "191000"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/k8s-ipam-configmap
  uid: 48b2646a-cfae-11e8-b1c4-005056b43773
rules:
- apiGroups:
  - ""
  resourceNames:
  - ipam-cm
  resources:
  - configmaps
  verbs:
  - create
  - get
  - update
  - patch
  - delete
- apiGroups:
  - ipam.nexinto.com
  resources:
  - ipaddresses
  verbs:
  - '*'

$ kubectl get clusterrolebindings k8s-ipam-configmap -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"k8s-ipam-configmap","namespace":""},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"k8s-ipam-configmap"},"subjects":[{"kind":"ServiceAccount","name":"k8s-ipam-configmap","namespace":"kube-system"}]}
  creationTimestamp: 2018-10-14T12:40:08Z
  name: k8s-ipam-configmap
  resourceVersion: "644246"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/k8s-ipam-configmap
  uid: 48bfee09-cfae-11e8-b1c4-005056b43773
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8s-ipam-configmap
subjects:
- kind: ServiceAccount
  name: k8s-ipam-configmap
  namespace: kube-system

Any idea what I should be looking at?

Thank you!