TimMoore
commented
6 years ago I think I've found the problem. GCP enables Role-Based Access Control (aka RBAC) by default in new Kubernetes clusters. This requires configuring roles to allow access to resources within the Kubernetes API. Lightbend Orchestration (specifically, the Akka Cluster Bootstrap component) uses the Kubernetes API to automatically form a cluster. Without binding your pods' service account to a role that grants access to the required resources, these API calls fail.
To correct this, you'll need to follow the instructions on this page for configuring role-based access control: https://developer.lightbend.com/docs/akka-management/current/discovery.html#discovery-method-kubernetes-api
For example, you can supply these Kubernetes resources to kubectl apply:
---
#
# Create a role, `pod-reader`, that can list pods and
# bind the default service account in the `default` namespace
# to that role.
#
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: pod-reader
rules:
- apiGroups: [""] # "" indicates the core API group
resources: ["pods"]
verbs: ["get", "watch", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: read-pods
subjects:
# Note the `name` line below. The first default refers to the namespace. The second refers to the service account name.
# For instance, `name: system:serviceaccount:myns:default` would refer to the default service account in namespace `myns`
- kind: User
name: system:serviceaccount:default:default
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.ioOnce you've created this role and role binding, your Lagom services should start correctly. You might want to tailor this to your specific security needs.
@lejoow please let us know if that fixes the problem for you. Even if it does, we can leave this issue open until we update the documentation.
lejoow
Canislupax
idoshamun
normenmueller
Bunyod
OguzhanSaltik
bahtiyarerden
ale222
zhangzhonglai
ktoso
I am not 100% sure if this is the issue specifics to my local settings or not. But every time I try to deploy the item-svc or bidding-svc to my Google KBE, I am getting this exception.
Resolve attempt failed! Cause: spray.json.DeserializationException: Object is missing required member 'items'