nginx ingress example need rbac setting for higher version of kubernetes( 1.6 and up)

[gogeof]

type

/kind feature

describe

• nginx ingress example need rbac setting for higher version of kubernetes( 1.6 and up)

detail

• When I try to use kube-lego in kubernetes v1.8.4, following the example of nginx, This error message is showing:

  I1128 03:26:41.456734       1 main.go:94] Using build: https://github.com/bprashanth/contrib.git - git-92b2bac
  W1128 03:27:11.548275       1 main.go:118] unexpected error getting runtime information: timed out waiting for the condition
  F1128 03:27:11.550794       1 main.go:121] no service with name nginx-ingress/default-http-backend found: services "default-http-backend" is forbidden: User "system:serviceaccount:nginx-ingress:default" cannot get services in the namespace "nginx-ingress"

[jgoulah]

applying this seems to resolve these errors, not sure if its perfect yet

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ingress
rules:
- apiGroups:
  - ""
  - "extensions"
  resources:
  - configmaps
  - secrets
  - services
  - endpoints
  - ingresses
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - "extensions"
  resources:
  - ingresses
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
- apiGroups:
  - "extensions"
  resources:
  - ingresses/status
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ingress-ns
  namespace: nginx-ingress
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - configmaps
  verbs:
  - list
- apiGroups:
  - ""
  resources:
  - services
  - configmaps
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - endpoints
  verbs:
  - get
  - create
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ingress-ns-binding
  namespace: nginx-ingress
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-ns
subjects:
  - kind: ServiceAccount
    name: default
    namespace: nginx-ingress
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ingress-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingress
subjects:
  - kind: ServiceAccount
    name: default
    namespace: nginx-ingress