Kubernetes-ingress: unable to run ingress-controller with rbac with role set to work on specific namespace instead of clusterrole

[ghost]

Describe the bug

* 1. I set following role with full access in users namespace*

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: users
name: role-users
rules:

• apiGroups:
  
  
  
  • ""
    
    resources:
  
  
  • services
  
  
  • endpoints
    
    verbs:
  
  
  • list
  
  
  • watch
  
  
• apiGroups:
  
  
  
  • ""
    
    resources:
  
  
  • configmaps
  
  
  • secrets
    
    verbs:
  
  
  • get
  
  
  • list
  
  
  • watch
  
  
• apiGroups:
  
  
  
  • ""
    
    resources:
  
  
  • pods
    
    verbs:
  
  
  • list
  
  
• apiGroups:
  
  
  
  • ""
    
    resources:
  
  
  • events
    
    verbs:
  
  
  • create
  
  
  • patch
  
  
• apiGroups:
  
  
  
  • extensions
    
    resources:
  
  
  • ingresses
    
    verbs:
  
  
  • list
  
  

- watch

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: role-user-binding
namespace: nginx-ingress
subjects:

• kind: ServiceAccount
  name: nginx-ingress-serviceaccount
  namespace: nginx-ingress
  roleRef:
  kind: Role
  name: role-user
  apiGroup: rbac.authorization.k8s.io

2. I see following errors in ingress logs

E0927 22:47:11.379035 1 reflector.go:205] github.com/nginxinc/kubernetes-ingress/nginx-controller/controller/controller.go:415: Failed to list *v1beta1.Ingress: ingresses.extensions is forbidden: User "system:serviceaccount:ngcc-ingress:ngcc-ic-serviceaccount" cannot list ingresses.extensions at the cluster scope

E0927 22:47:12.375366 1 reflector.go:205] github.com/nginxinc/kubernetes-ingress/nginx-controller/controller/controller.go:410: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:ngcc-ingress:ngcc-ic-serviceaccount" cannot list endpoints at the cluster scope

E0927 22:47:12.375854 1 reflector.go:205] github.com/nginxinc/kubernetes-ingress/nginx-controller/controller/controller.go:409: Failed to list *v1.Service: services is forbidden: User "system:serviceaccount:ngcc-ingress:ngcc-ic-serviceaccount" cannot list services at the cluster scope

E0927 22:47:12.378593 1 reflector.go:205] github.com/nginxinc/kubernetes-ingress/nginx-controller/controller/controller.go:411: Failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:ngcc-ingress:ngcc-ic-serviceaccount" cannot list secrets at the cluster scope

Does ingress controller need clusterrole and why?

[pleshakov]

@devendra-nvidia
by default, the Ingress Controller monitors for Ingress and other resources across all the namespaces. That is why a ClusterRole and a ClusterRoleBinding are required. We provide those in https://github.com/nginxinc/kubernetes-ingress/tree/master/deployments/rbac

If you would like to only use the Ingress Controller for a certain namespace, you need to:

• Set the -watch-namespace command line argument in the IC manifests. for example, -watch-namespace=my-namespace https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/cli-arguments.md
• Create appropriate Roles and RolesBinding for that namespace

Note, the Ingress Controller also requires access to the default secret and the configmap. See https://github.com/nginxinc/kubernetes-ingress/blob/master/deployments/deployment/nginx-ingress.yaml#L37 and https://github.com/nginxinc/kubernetes-ingress/blob/master/deployments/deployment/nginx-ingress.yaml#L36 A Role and a RoleBinding to access that secret and the configmap must also be created.

[ghost]

@pleshakov Is there a way to specify more than one namespace to watch?

[pleshakov]

@devendra-nvidia unfortunately, this is not supported.