Provide kubernetes role for RBAC #4

vdboor · 2017-12-27T22:32:44Z

As of Kubernetes 1.8+, RBAC is enabled by default. You'll need the following setup to allow the program to access the events:

kubectl create sa sentry-kubernetes
kubectl create clusterrole sentry-kubernetes --verb=get,list,watch --resource=events
kubectl create clusterrolebinding sentry-kubernetes --clusterrole=sentry-kubernetes --user=sentry-kubernetes

kubectl run sentry-kubernetes \
  --image bretthoerner/sentry-kubernetes \
  --serviceaccount=sentry-kubernetes \
  --env="DSN=$YOUR_DSN"

When you add --dry-run -o yaml to all commands, you'll get the .yml definition files.

The text was updated successfully, but these errors were encountered:

ghost · 2018-01-24T14:32:46Z

🤔 Still running into RBAC issues after deploying the RBAC roles.

2018-01-24 14:29:13,006 Exception when calling CoreV1Api-&gt;list_event_for_all_namespaces: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Wed, 24 Jan 2018 14:29:13 GMT', 'Content-Length': '326'})
HTTP response body: b'{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"events is forbidden: User \\"system:serviceaccount:default:sentry-kubernetes\\" cannot watch events at the cluster scope: Unknown user \\"system:serviceaccount:default:sentry-kubernetes\\"","reason":"Forbidden","details":{"kind":"events"},"code":403}\n'

The serviceaccount was created successfully.

➜  kubectl get sa
NAME                SECRETS   AGE
<..snip..>
sentry-kubernetes   1         4m
<..snip..>

bretthoerner · 2018-01-24T17:26:27Z

If you -o yaml the sentry-kubernetes what is the output?

ghost · 2018-01-25T09:03:26Z

› kubectl get deployment sentry-kubernetes -o yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
  creationTimestamp: 2018-01-24T14:27:44Z
  generation: 1
  labels:
    run: sentry-kubernetes
  name: sentry-kubernetes
  namespace: default
  resourceVersion: "580395"
  selfLink: /apis/extensions/v1beta1/namespaces/default/deployments/sentry-kubernetes
  uid: bddc1622-0112-11e8-b7ed-42010a840009
spec:
  replicas: 1
  selector:
    matchLabels:
      run: sentry-kubernetes
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        run: sentry-kubernetes
    spec:
      containers:
      - env:
        - name: DSN
          value: <..snip..>
        image: bretthoerner/sentry-kubernetes
        imagePullPolicy: IfNotPresent
        name: sentry-kubernetes
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: sentry-kubernetes
      serviceAccountName: sentry-kubernetes
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: 2018-01-24T14:27:44Z
    lastUpdateTime: 2018-01-24T14:27:44Z
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

kubectl get sa sentry-kubernetes -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-01-24T14:26:52Z
  name: sentry-kubernetes
  namespace: default
  resourceVersion: "580250"
  selfLink: /api/v1/namespaces/default/serviceaccounts/sentry-kubernetes
  uid: 9f5877b0-0112-11e8-9431-42010a840008
secrets:
- name: sentry-kubernetes-token-nq2f9

bretthoerner · 2018-01-25T15:43:51Z

Hmm, I guess neither of those list permissions?

I was hoping to verify the --verb=get,list,watch --resource=events part of the role worked.

ghost · 2018-01-25T18:43:30Z

I've manually verified, and role has the verbs and resource attached, but for some reason the container is not picking it up correctly, or it's not the correct role.

vdboor · 2018-01-29T09:19:36Z

there you go:

This is what I have in my cluster (extracted with kubectl get -o yaml and cleaned up)

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sentry-kubernetes
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sentry-kubernetes
rules:
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sentry-kubernetes
roleRef:
  kind: ClusterRole
  name: sentry-kubernetes
subjects:
- kind: ServiceAccount
  name: sentry-kubernetes

bretthoerner · 2018-01-29T14:11:51Z

Thanks!

@chnkr Can you diff with yours?

vdboor · 2018-02-01T10:38:04Z

It looks like a second set of verbs for the "secrets" resource was missing in my first command line example. That's something I probably found later. Most of it was discovered by analyzing the container logs.

ghost · 2018-02-02T11:53:46Z

That seems to be the case indeed! Going to give it a go and see if this works 👍

ghost · 2018-02-02T12:21:32Z

🎉 It seems to be working after making some minor changes to the ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sentry-kubernetes
  namespace: default
roleRef:
  kind: ClusterRole
  name: sentry-kubernetes
  apiGroup: rbac.authorization.k8s.io  
subjects:
- kind: ServiceAccount
  name: sentry-kubernetes
  namespace: default

bretthoerner · 2018-02-02T13:27:44Z

Awesome, does anyone know what (if any) adjustments need to be made to the original commands @vdboor posted?

kubectl create sa sentry-kubernetes
kubectl create clusterrole sentry-kubernetes --verb=get,list,watch --resource=events
kubectl create clusterrolebinding sentry-kubernetes --clusterrole=sentry-kubernetes --user=sentry-kubernetes

kubectl run sentry-kubernetes \
  --image bretthoerner/sentry-kubernetes \
  --serviceaccount=sentry-kubernetes \
  --env="DSN=$YOUR_DSN"

I'd like to put it in the README if it makes sense.

vdboor · 2018-02-05T13:23:11Z

One option would be to provide .yml files, and use kubectl apply -f <url to github yml file>.

A second option is to fix the helm chart PR: helm/charts#2708 which gives even easier installation options.

gianrubio · 2018-02-16T09:26:41Z

I did a new PR using the commits from #2708, helm/charts#3748

wichert · 2019-06-04T14:50:33Z

FWIW instead of using a cluster role you can also use a normal role and pass in the EVENT_NAMESPACES environment variable to limit monitoring to specific namespaces.

Fleuri · 2020-04-24T12:56:57Z

Sorry for necroing an old thread, but I'm getting Exception when calling CoreV1Api->list_event_for_all_namespaces: (403) using GKE. Is there some managed cluster quirk I'm missing? If I change ClusterRoleBinding -> subjects -> Kind to ServiceAccount instead of User, I get the same exception but with code 401 Unauthorized.

shovalaharoni99 · 2021-03-29T07:24:08Z

Still running into RBAC issues after deploying the RBAC roles.

2018-01-24 14:29:13,006 Exception when calling CoreV1Api-&gt;list_event_for_all_namespaces: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Wed, 24 Jan 2018 14:29:13 GMT', 'Content-Length': '326'})
HTTP response body: b'{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"events is forbidden: User \\"system:serviceaccount:default:sentry-kubernetes\\" cannot watch events at the cluster scope: Unknown user \\"system:serviceaccount:default:sentry-kubernetes\\"","reason":"Forbidden","details":{"kind":"events"},"code":403}\n'

The serviceaccount was created successfully.

➜  kubectl get sa
NAME                SECRETS   AGE
<..snip..>
sentry-kubernetes   1         4m
<..snip..>

I also encountered this problem, did someone managed to solve it ?

Frankkkkk · 2021-03-29T08:15:49Z

Take a look at the helm chart https://github.com/sentry-kubernetes/charts/tree/develop/sentry-kubernetes/templates it's not that complicated: you only need a clusterrole + clusterrolebinding.
Cheers

shovalaharoni99 · 2021-04-04T07:45:51Z

ן already did that, and it still not working.
I don't understand why I'm getting this error.
@Frankkkkk

jcscottiii mentioned this issue Mar 1, 2018

[incubator/sentry-kubernetes] add missing clusterrole and clusterrolebinding helm/charts#3942

Merged

karimkawambwa pushed a commit to Atlas-One/sentry-kubernetes that referenced this issue Feb 26, 2024

test: Create unit test for watch_pods (getsentry#4)

431c9fd

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Provide kubernetes role for RBAC #4

Provide kubernetes role for RBAC #4

vdboor commented Dec 27, 2017 •

edited

Loading

ghost commented Jan 24, 2018

bretthoerner commented Jan 24, 2018

ghost commented Jan 25, 2018 •

edited by ghost

Loading

bretthoerner commented Jan 25, 2018

ghost commented Jan 25, 2018

vdboor commented Jan 29, 2018

bretthoerner commented Jan 29, 2018

vdboor commented Feb 1, 2018

ghost commented Feb 2, 2018

ghost commented Feb 2, 2018

bretthoerner commented Feb 2, 2018

vdboor commented Feb 5, 2018

gianrubio commented Feb 16, 2018

wichert commented Jun 4, 2019

Fleuri commented Apr 24, 2020

shovalaharoni99 commented Mar 29, 2021

Frankkkkk commented Mar 29, 2021

shovalaharoni99 commented Apr 4, 2021

Provide kubernetes role for RBAC #4

Provide kubernetes role for RBAC #4

Comments

vdboor commented Dec 27, 2017 • edited Loading

ghost commented Jan 24, 2018

bretthoerner commented Jan 24, 2018

ghost commented Jan 25, 2018 • edited by ghost Loading

bretthoerner commented Jan 25, 2018

ghost commented Jan 25, 2018

vdboor commented Jan 29, 2018

bretthoerner commented Jan 29, 2018

vdboor commented Feb 1, 2018

ghost commented Feb 2, 2018

ghost commented Feb 2, 2018

bretthoerner commented Feb 2, 2018

vdboor commented Feb 5, 2018

gianrubio commented Feb 16, 2018

wichert commented Jun 4, 2019

Fleuri commented Apr 24, 2020

shovalaharoni99 commented Mar 29, 2021

Frankkkkk commented Mar 29, 2021

shovalaharoni99 commented Apr 4, 2021

vdboor commented Dec 27, 2017 •

edited

Loading

ghost commented Jan 25, 2018 •

edited by ghost

Loading