ContainerSolutions / ContainerSolutions/registry-tooling
create-certs and copy-certs are unable to connect to k8s
- Dominant language
- Shell
- Stars
- 70
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
When starting
`./reg-tool.sh install-k8s-reg`
The scripts stays in the 'Waiting for job to complete' phase indefinitely.
The logs of the create-certs-20cm2 pod show:
```
Error from server (Forbidden): User "system:serviceaccount:default:default" cannot delete secrets in the namespace "default". (delete secrets registry-cert)
Error from server (Forbidden): User "system:serviceaccount:default:default" cannot delete secrets in the namespace "kube-system". (delete secrets registry-cert)
Error from server (Forbidden): User "system:serviceaccount:default:default" cannot delete secrets in the namespace "kube-system". (delete secrets registry-key)
Generating a 4096 bit RSA private key
...................................++
.................++
writing new private key to 'certs/domain.key'
-----
Error from server (Forbidden): User "system:serviceaccount:default:default" cannot create secrets in the namespace "default". (post secrets)
```
If I could pass my ~/.kube/config file with authentication and certificates to the create_certs and copy_certs containers, the operation would succeed.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with ./reg-tool.sh install-k8s-reg and inspect how the create_certs and copy_certs containers connect to Kubernetes. Compare their authentication with the reported ~/.kube/config requirement, then verify that the operation can create and delete the registry secrets and that the job completes instead of waiting indefinitely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, shell
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100