search

kelseyhightower / kubernetes-the-hard-way

Bootstrap Kubernetes the hard way. No scripts.
Apache License 2.0
40.96k stars 14.02k forks source link

Error from server (Forbidden): componentstatuses is forbidden: User "admin" cannot list resource "componentstatuses" in API group "" at the cluster scope #666

Open suthetontd opened 3 years ago

suthetontd commented 3 years ago

Hi,

I’m trying to setup the K8S and I have some problem.

I'm currently on 08-bootstrapping-kubernetes-controllers.md and then

I got error message "Error from server (Forbidden): componentstatuses is forbidden: User "admin" cannot list resource "componentstatuses" in API group "" at the cluster scope"

when I used the command line "kubectl get componentstatuses --kubeconfig admin.kubeconfig" on controller node for Verification.

and used the command line "kubectl cluster-info dump" then I got the message like this :

“The connection to the server localhost:8080 was refused - did you specify the right host or port?”

Could you tell me how to solve this problem, please?

5555555
khanabid20 commented 2 years ago

Do we know what is/was the fix ?

aarengee commented 2 years ago

Was stuck on a similar line unable to do anything using admin user.

I checked user admin's rights using kubectl auth can-i --list --kubeconfig admin.kubeconfig command

Output 

selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]
[/api/*]            []               [get]
[/api]              []               [get]
....

Turns out while editing the csr's to suit my region / name I made the name[].O key i.e. organization in the admin-csr.json to Kubernetes instead of system:masters which is a group which is hardcoded into the Kubernetes API server source code as having unrestricted rights to the Kubernetes API server.

Post that the above command gave me 

Resources                                       Non-Resource URLs   Resource Names   Verbs
*.*                                             []                  []               [*]
                                                [*]                 []               [*]
.......

And I was able to proceed with setting up the roles and onwards. Great learning indeed.

FRANKGUO1 commented 2 months ago

i have the same issue,how to solve it?