Kind: tiller permission errors

[snickerson-holon]

I am getting a failed build, after what appears to be much success in builds.
This is running Arch Linux on a laptop, 32 G RAM and plenty of room.
I am lost, looking for a clue.
To my eye, it has something to do with the pull image, but why escapes me.

+++ [0820 20:19:15] Syncing out of container +++ [0820 20:19:22] Building images: linux-amd64 +++ [0820 20:19:22] Starting docker build for image: kube-apiserver-amd64 +++ [0820 20:19:22] Starting docker build for image: kube-controller-manager-amd64 +++ [0820 20:19:22] Starting docker build for image: kube-scheduler-amd64 +++ [0820 20:19:22] Starting docker build for image: kube-proxy-amd64 +++ [0820 20:19:29] Deleting docker image k8s.gcr.io/kube-scheduler-amd64:v1.17.0-alpha.0.350_7a81ecd1916477 +++ [0820 20:19:29] Deleting docker image k8s.gcr.io/kube-controller-manager-amd64:v1.17.0-alpha.0.350_7a81ecd1916477 +++ [0820 20:19:30] Deleting docker image k8s.gcr.io/kube-apiserver-amd64:v1.17.0-alpha.0.350_7a81ecd1916477 +++ [0820 20:19:31] Deleting docker image k8s.gcr.io/kube-proxy-amd64:v1.17.0-alpha.0.350_7a81ecd1916477 +++ [0820 20:19:31] Docker builds done Created symlink /etc/systemd/system/multi-user.target.wants/kubelet.service → /kind/systemd/kubelet.service. Created symlink /etc/systemd/system/kubelet.service → /kind/systemd/kubelet.service. Pulling: k8s.gcr.io/kube-apiserver:v1.17.0-alpha.0.350_7a81ecd1916477 ERRO[20:19:44] Image build Failed! Failed to pull Images: exit status 1 Error: error building node image: exit status 1

[BenTheElder]

hi, what version of kind are you using / how did you install it?

that looks an awful lot like a bug we should have fixed in the latest release, it shouldn't actually need to pull kube-apiserver

[snickerson-holon]

Verified it was an older version. I just jumped the gun and assumed I ran the command incorrect.
Thanks for the reply.
Now I have a multi-kind cluster running, and trying to get helm/tiller to work. Helm installs tiller, but tiller cant install charts, permissions it seems.

[BenTheElder]

kind runs with kubeadm defaults for the most part, possibly this is related to RBAC?

https://kubernetes.io/docs/reference/access-authn-authz/rbac/
https://github.com/helm/helm/blob/master/docs/rbac.md

[snickerson-holon]

Thats what I thought, but out of the box I get errors, and I have tried the RBAC suggestions in the helm docs for roles and such, same outcome. I will look at the other link. Thanks again.

[BenTheElder]

/retitle tiller permission errors

Can you share some more details of the setup and errors? I don't use tiller but someone might be able to help.

Also FWIW I would suggest considering using helm without tiller for better security.

[snickerson-holon]

I found rbac manifests to get me going, looking thru how they work to better tweak them.
RBAC is not for the feint of heart.
Is Tillerless ready for prime time? If you have a link to a good walk thru much appreciated, I will start the DuckDuckGo search as well.
Thanks for the reply!

[tao12345666333]

About tillerless you have at least two choices.

1. the easiest way, you can use Helm v3.

or

1. run tiller locally then you can just skip setup RBAC. (for Helm v2)

[BenTheElder]

https://helm.sh/docs/helm/#helm-template can work without tiller as well

I'm going to close this out for now, https://helm.sh/docs/using_helm/#role-based-access-control should cover RBAC, essentially all clusters should be created with RBAC for quite some time now. RBAC was stable in Kubernetes 1.8

If you have more questions, feel free to file another issue our jump into the #kind slack channel on the kubernetes slack 😄