Azure-docs: User "clusterUser" cannot get resource "pods/log" in API group "" in the namespace "default": RBAC: clusterrole.rbac.authorization.k8s.io "containerHealth-read-logs-global" not found

[loopfish]

I have an RBAC-enabled AKS cluster. Contain Insights solution is enabled. I have created the RBAC authorization ClusterRole (containerHealth-log-reader) and ClusterRoleBinding (containerHealth-read-logs-global) as per this documentation:

PS C:\Users\014357> kubectl get clusterrole -name containerHealth-log-reader -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2019-10-18T10:50:44Z"
name: containerHealth-log-reader
resourceVersion: "3454"
selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/containerHealth-log-reader
uid: 2e5b1a2e-fbc4-47c1-a6d8-5b903551c7de
rules:

• apiGroups:
  
  
  
  • ""
    
    resources:
  
  
  • pods/log
  
  
  • events
    
    verbs:
  
  
  • get
  
  
  • list
  
  

PS C:\Users> kubectl get clusterrolebinding -name containerHealth-read-logs-global -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
creationTimestamp: "2019-10-18T10:50:44Z"
name: containerHealth-read-logs-global
resourceVersion: "3455"
selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/containerHealth-read-logs-global
uid: a490324a-12c8-4c4b-82a0-68d79b0d7cfb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: containerHealth-read-logs-global
subjects:

• apiGroup: rbac.authorization.k8s.io
  kind: User
  name: clusterUser
  namespace: default

I cannot access the live logs in the Azure portal:

User "clusterUser" cannot get resource "pods/log" in API group "" in the namespace "default": RBAC: clusterrole.rbac.authorization.k8s.io "containerHealth-read-logs-global" not found

What am I missing, or what else needs to be done?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: a113bacb-b999-8f0d-a66b-748e60e5c4d7
• Version Independent ID: d7766575-5ef8-4f9a-49e5-2dbd7696d18e
• Content: View Azure Monitor for containers logs in real time
• Content Source: articles/azure-monitor/insights/container-insights-live-logs.md
• Service: azure-monitor
• GitHub Login: @MGoedtel
• Microsoft Alias: magoedte

[MarileeTurscak-MSFT]

@loopfish
Thanks for your feedback! We will investigate and update as appropriate.

[erikverwer]

You have to use a username of an existing AAD User. (UPN or ObjectID) so not "ClusterUser"

[loopfish]

@erikverwer why? I'm not using an AAD-authenticated cluster. Surely its the omsagent service that should be requesting this cluster role binding, not one of my AAD users...

[erikverwer]

Ah sorry, i'm assumed that you were using AAD RBAC.

[MGoedtel]

@loopfish - We are getting ready to publish an updated version of the documentation that includes a revised version of the yaml config template for RBAC-enabled clusters. Can you save this and update your configuration to see if it corrects your issue?

apiVersion: rbac.authorization.k8s.io/v1 
kind: ClusterRole 
metadata: 
   name: containerHealth-log-reader 
rules: 
    - apiGroups: ["", "metrics.k8s.io", "extensions", "apps"] 
      resources: 
         - "pods/log" 
         - "events" 
         - "nodes" 
         - "pods" 
         - "deployments" 
         - "replicasets" 
      verbs: ["get", "list"] 
--- 
apiVersion: rbac.authorization.k8s.io/v1 
kind: ClusterRoleBinding 
metadata: 
   name: containerHealth-read-logs-global 
roleRef: 
   kind: ClusterRole 
   name: containerHealth-log-reader 
   apiGroup: rbac.authorization.k8s.io 
subjects: 
- kind: User 
  name: clusterUser 
  apiGroup: rbac.authorization.k8s.io

Thanks.

[loopfish]

nice one @MGoedtel - that sorted it, thank you. To be honest, I should have spotted that myself - the cluster role binding was referencing itself, rather that the role. I did have to delete the existing cluster role binding - Terraform said it updated the crb, but in fact it didn't, so I had to delete it manually and recreated it. FYI.

[MGoedtel]

Glad to hear your issue is resolved. #please-close.