Ingress-nginx: Permissions errors obscured by "nice" error message

[djmitche]

https://github.com/kubernetes/ingress-nginx/blob/c3ce6b892e5f1cc1066f81c19482dded2901ad45/cmd/nginx/main.go#L96-L98

This code replaces what could be a useful error message with one that basically says "oh noes! something's wrong!" and gives no indication of what is actually wrong. Well, it gives a little indication because I can find this line in the source and see that the error message contained "cannot get services in the namespace", but seeing the whole error message would help.

[aledbf]

@djmitche I agree with you but at this point, the error from client-go is not clear about the reason. Using the Contains method we can deduce the error is related to authorization (we cannot get which things are missing in the permissions from the pod itself)

[aledbf]

Closing. I suggest you build a custom image to see in the logs what I just described.

[djmitche]

I respectfully disagree.

You are taking an error which contains at least six useful words, and replacing it with one which contains only one vaguely categorical word ("Authorization").

At the very least, show the original error in addition to the friendly error message.

[aledbf]

@djmitche here https://github.com/kubernetes/ingress-nginx/issues/1242 you can see an example of the error returned by client-go

F0824 20:10:03.257520      37 launch.go:122] no service with name kube-system/default-http-backend found: User "system:serviceaccount:default:default" cannot get services in the namespace "kube-system". (get services default-http-backend)

_What's the error here?_

• there is no service kube-system/default-http-backend ?
• what it means User "system:serviceaccount:default:default" cannot get services in the namespace "kube-system". (get services default-http-backend)
• an error in the ingress controller? (this was reported as an error more than once)

Please don't see this as a developer but as a user not familiar with go, client-go Kubernetes or RBAC.

[djmitche]

Please don't see this as a developer but as a user not familiar with go, client-go Kubernetes or RBAC.

I think I'm misunderstanding you -- are you suggesting that this service is intended for people not familiar with Kubernetes?

I'm not a developer, but I am a user of your application. The quoted error message would tell me a lot (I wonder if it's the error I encountered, but of course I don't know): something tried to use a default-http-backend service (hm, probably related to --default-backend-service?) and something about the kube-system namespce. So I could go looking for that service, and I could also look at role configuration to make sure such a service was accessible.

We can both get what we want. Please at least include the error:

✖ An error occurred starting up. This often occurs when the cluster is running with a restrictive Authorization mode and the Ingress controller does not have the required permissions to operate normally. The error is: "no service with name kube-system/default-http-backend found: User "system:serviceaccount:default:default" cannot get services in the namespace "kube-system". (get services default-http-backend)"

[frgomes]

I'm struggling with with kind of trouble for weeks. I'm a software developer but I'm not interested on Go programming language at all. From this perspective, I'm just an end user and I simply don't have any hint about what could possibly be wrong.

End users in general ask for help from developers or from technical support personnel. Then end users are asked to provide some useful error message which could help solve the difficulty. The "problem" of this "nice" error message is that it is completely useless for giving any direction to the root cause of the issue.