1

Deployed Ambassador in RBAC environment and created service with node port

[root@-1 xxxxx]# kb get svc -n ambassador
NAME               TYPE        CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE
ambassador         NodePort    172.18.0.216   12.197.35.74   80:31270/TCP,443:31729/TCP   17h

Tried to access UI https://12.197.35.74/, getting below error

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"",
  "reason": "Forbidden",
  "details": {  },
  "code": 403
}

Look like I am missing something related to RBAC, any help high appreciated

Masudur Rahman
  • 1,585
  • 8
  • 16
Rayees Namathponnan
  • 217
  • 2
  • 13

1 Answers1

0

This error means that you are not authorized to access the API server because it doesn’t know who you are. This is good, otherwise anyone could manipulate your cluster.

The latest kubernetes deployment tools enable RBAC on the cluster. Ambassador is relegated to the catch-all user system:anonymous when it accesses https://12.197.35.74/. This user has almost no privileges on kube-apiserver.

The bottom-line is, ambassador needs to authenticate with kube-apiserver - either with a bearer token or a client cert that's signed by the k8s cluster's CA key.

  1. Create a ServiceAccount in k8s for the plugin
  2. Create an RBAC profile (ie. Role/RoleBinding or ClusterRole/ClusterRoleBinding) that's tied to the ServiceAccount
  3. Config the plugin to use the ServiceAccount's token when accessing the URL https://12.197.35.74/

The Kubernetes API server is the brain of your Kubernetes cluster. You should restrict access to it to the absolute minimum, limiting access from outside of the cluster to the API server using standard networking and firewalling mechanisms, and from within the cluster using a Kubernetes network policy.

Take a look: kube-apiserver-error, kubernetes-api-server, kube-apiserver-forbidden-messages, systemanonymous-cannot-get-path.

Malgorzata
  • 6,409
  • 1
  • 10
  • 27
  • Thanks, I was running API server in 443 and Ambassador also trying to launch ambassador-admin on 443 port, changed Ambassador port to 8443 and started working – Rayees Namathponnan Sep 15 '20 at 17:18