Cannot create resource "customresourcedefinitioins" #61

rchojn · 2020-08-10T08:55:51Z

During installing KEDA by using helm install keda kedacore/keda I've got following error:

Error: failed to install CRD crds/keda.k8s.io_scaledobjects_crd.yaml: customresourcedefinitions.apiextensions.k8s.io is forbidden: User "u-f6efqrxwsu" cannot create resource "customresourcedefinitions" in API group "apiextensions.k8s.io" at the cluster scope

The text was updated successfully, but these errors were encountered:

tomkerkhove · 2020-08-10T13:18:44Z

It looks like your user does not have permissions to do so, is this an RBAC-enabled cluster?

rchojn · 2020-08-11T09:51:19Z

@tomkerkhove - can it be slightly modified to operate only on namespace area? not cluster?

rules:

apiGroups: [""]
resources: ["pods", "persistentvolumeclaims", "secrets", "podtemplates", "serviceaccounts", "services", "replicationcontrollers", "endpoints", "configmaps", "events", "limitranges"]
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]

apiGroups: [""]
resources: ["namespaces"]
verbs: ["get"]

apiGroups: ["apps"]
resources: ["deployments", "replicasets", "daemonsets", "statefulsets", "controllerrevisions"]
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]

apiGroups: ["extensions"]
resources: ["ingresses", "deployments"]
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]

apiGroups: ["batch"]
resources: ["jobs", "cronjobs"]
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]

zroubalik · 2020-08-11T09:59:27Z

CustomResourceDefinitions requires admin permissions, those are cluster-wide resources.

tomkerkhove · 2020-10-26T10:39:37Z

Can we close this issue @gardnerdev ?

* All our tweaks should go here If there is another thing to add to our fork, pls add it here. Example: ``` echo -e "#foo?\n\n bar?" > foo-bar.md # Pls keep adding the changes to standalone files that are not present in the upstream to mitigate the risk of conflict add foo-bar.md git commit -s --ammend yada yada ``` Signed-off-by: Jirka Kremser <[email protected]> Signed-off-by: Jan Wozniak <[email protected]> Signed-off-by: Jirka Kremser <[email protected]> * ensure keda ns in smoketests before chart installation (kedacore#36) Signed-off-by: Jan Wozniak <[email protected]> * smoke_tests: wait for deployments availability (kedacore#37) Signed-off-by: Jan Wozniak <[email protected]> * fix keda chart deployment smoketest check missing ns (kedacore#38) Signed-off-by: Jan Wozniak <[email protected]> * Don't skip the publish step (kedacore#39) Signed-off-by: Jirka Kremser <[email protected]> * http-add-on: allow fetching certs from secrets (kedacore#40) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: disable explicit tls secret mount Signed-off-by: Jan Wozniak <[email protected]> * restricted scc (kedacore#41) Signed-off-by: Zbynek Roubalik <[email protected]> * ci: refactor kedify chart release trigger (kedacore#42) Signed-off-by: Jan Wozniak <[email protected]> * bump kube-rbax-proxy to v0.16.0 (kedacore#43) Signed-off-by: Zbynek Roubalik <[email protected]> * ci: fix missing quote and pipe Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: attempt HTTP2 upgrade by default (kedacore#45) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: allow configuring prometheus and otel collectors (kedacore#46) * http-add-on: allow configuring prometheus and otel collectors Signed-off-by: Jan Wozniak <[email protected]> * helm-docs Signed-off-by: Jan Wozniak <[email protected]> --------- Signed-off-by: Jan Wozniak <[email protected]> * gh release chart: fix env var evaluation (kedacore#47) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: metrics service (kedacore#48) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: disable interceptor pdb (kedacore#49) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: RBAC to emit events (kedacore#50) Signed-off-by: Jan Wozniak <[email protected]> * First shot of the agent helm chart (kedacore#51) * All our tweaks should go here If there is another thing to add to our fork, pls add it here. Example: ``` echo -e "#foo?\n\n bar?" > foo-bar.md # Pls keep adding the changes to standalone files that are not present in the upstream to mitigate the risk of conflict add foo-bar.md git commit -s --ammend yada yada ``` Signed-off-by: Jirka Kremser <[email protected]> Signed-off-by: Jan Wozniak <[email protected]> Signed-off-by: Jirka Kremser <[email protected]> * ensure keda ns in smoketests before chart installation (kedacore#36) Signed-off-by: Jan Wozniak <[email protected]> * smoke_tests: wait for deployments availability (kedacore#37) Signed-off-by: Jan Wozniak <[email protected]> * fix keda chart deployment smoketest check missing ns (kedacore#38) Signed-off-by: Jan Wozniak <[email protected]> * Don't skip the publish step (kedacore#39) Signed-off-by: Jirka Kremser <[email protected]> * http-add-on: allow fetching certs from secrets (kedacore#40) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: disable explicit tls secret mount Signed-off-by: Jan Wozniak <[email protected]> * restricted scc (kedacore#41) Signed-off-by: Zbynek Roubalik <[email protected]> * ci: refactor kedify chart release trigger (kedacore#42) Signed-off-by: Jan Wozniak <[email protected]> * bump kube-rbax-proxy to v0.16.0 (kedacore#43) Signed-off-by: Zbynek Roubalik <[email protected]> * ci: fix missing quote and pipe Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: attempt HTTP2 upgrade by default (kedacore#45) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: allow configuring prometheus and otel collectors (kedacore#46) * http-add-on: allow configuring prometheus and otel collectors Signed-off-by: Jan Wozniak <[email protected]> * helm-docs Signed-off-by: Jan Wozniak <[email protected]> --------- Signed-off-by: Jan Wozniak <[email protected]> * gh release chart: fix env var evaluation (kedacore#47) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: metrics service (kedacore#48) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: disable interceptor pdb (kedacore#49) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: RBAC to emit events (kedacore#50) Signed-off-by: Jan Wozniak <[email protected]> * First shot of the agent helm chart Signed-off-by: Jirka Kremser <[email protected]> * more granular rbac Signed-off-by: Jirka Kremser <[email protected]> * more granular rbac vol 2 Signed-off-by: Jirka Kremser <[email protected]> * Install also CRD and CR if requested, this is done using pre install hook (for crd) and post install hook for CR Signed-off-by: Jirka Kremser <[email protected]> * fixes for agent chart (kedacore#52) * fixes for agent chart Signed-off-by: Jan Wozniak <[email protected]> * image tag proposal Signed-off-by: Jan Wozniak <[email protected]> * add cluster name + option to disable kedifyconfig Signed-off-by: Jan Wozniak <[email protected]> * simplify kedify cr template Signed-off-by: Jan Wozniak <[email protected]> * narrow down autowiring rbac Signed-off-by: Jan Wozniak <[email protected]> --------- Signed-off-by: Jan Wozniak <[email protected]> --------- Signed-off-by: Jirka Kremser <[email protected]> Signed-off-by: Jan Wozniak <[email protected]> Signed-off-by: Zbynek Roubalik <[email protected]> Co-authored-by: Jan Wozniak <[email protected]> Co-authored-by: Zbynek Roubalik <[email protected]> Co-authored-by: Jan Wozniak <[email protected]> * add helm repos (templating failed because of dependent charts) (kedacore#53) Signed-off-by: Jirka Kremser <[email protected]> * Don't wait for agent to be ready (for now) (kedacore#54) Signed-off-by: Jirka Kremser <[email protected]> * Turn off linting for stefanprodan/helm-gh-pages action + add dependen… (kedacore#55) Turn off linting for stefanprodan/helm-gh-pages action + add dependencies + icon Signed-off-by: Jirka Kremser <[email protected]> * agent: configurable autowire and metrics RBAC (kedacore#56) Signed-off-by: Jan Wozniak <[email protected]> * agent: bump image to v0.1.1 (kedacore#57) Signed-off-by: Jan Wozniak <[email protected]> * http-add-on: bump version to v0.8.1-0 (kedacore#58) * kedify-agent: disable istio sidecar injection for CR and CRD creating jobs (kedacore#60) kedifi-agent: disable istio sidecar injection for CR and CRD creating jobs Signed-off-by: Jan Wozniak <[email protected]> * Add install mechanism for PRPs Signed-off-by: Jirka Kremser <[email protected]> --------- Signed-off-by: Jirka Kremser <[email protected]> Signed-off-by: Jan Wozniak <[email protected]> Signed-off-by: Zbynek Roubalik <[email protected]> Signed-off-by: Jirka Kremser <[email protected]> Co-authored-by: Jan Wozniak <[email protected]> Co-authored-by: Zbynek Roubalik <[email protected]> Co-authored-by: Jan Wozniak <[email protected]>

triage-new-issues bot added the triage label Aug 10, 2020

tomkerkhove added question Further information is requested and removed triage labels Oct 26, 2020

tomkerkhove closed this as completed Nov 5, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot create resource "customresourcedefinitioins" #61

Cannot create resource "customresourcedefinitioins" #61

rchojn commented Aug 10, 2020

tomkerkhove commented Aug 10, 2020

rchojn commented Aug 11, 2020

zroubalik commented Aug 11, 2020

tomkerkhove commented Oct 26, 2020

Cannot create resource "customresourcedefinitioins" #61

Cannot create resource "customresourcedefinitioins" #61

Comments

rchojn commented Aug 10, 2020

tomkerkhove commented Aug 10, 2020

rchojn commented Aug 11, 2020

zroubalik commented Aug 11, 2020

tomkerkhove commented Oct 26, 2020