[BUG] yurthub cannot work correctly in k8s 1.20 cluster

[SataQiu]

What happened:
The following error occurred：

E0823 12:22:20.486268       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:22:20.516740       1 util.go:215] yurthub list services: /api/v1/services?limit=500&resourceVersion=0 with status code 200, spent 59.720095ms
E0823 12:22:20.516934       1 cache_manager.go:350] failed to decode response in saveOneObject couldn't get version/kind; json parse error: invalid character '\x1f' looking for beginning of value
E0823 12:22:20.516942       1 remote.go:140] yurthub list services: https://apiserver.cluster.local:6443/api/v1/services?limit=500&resourceVersion=0 response cache ended with error, couldn't get version/kind; json parse error: invalid character '\x1f' looking for beginning of value
I0823 12:22:20.520837       1 util.go:232] start proxying: get /api/v1/services?allowWatchBookmarks=true&resourceVersion=442535&timeout=5m15s&timeoutSeconds=315&watch=true, in flight requests: 1
I0823 12:22:21.514832       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:22:21.540750       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 25.851737ms
E0823 12:22:21.540902       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:22:23.569991       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:22:23.594104       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 24.033119ms
E0823 12:22:23.594261       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:22:28.316841       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:22:28.341783       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 24.884844ms
E0823 12:22:28.341973       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:22:39.981707       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:22:40.005969       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 24.207788ms
E0823 12:22:40.006142       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:22:59.008791       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:22:59.037817       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 28.96778ms
E0823 12:22:59.038022       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:23:28.500216       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:23:28.524789       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 24.496986ms
E0823 12:23:28.524993       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:23:40.359986       1 connrotation.go:48] close connection from 172.31.241.61:35384 to apiserver.cluster.local:6443 for hub certificate manager dialer, remain 0 connections
I0823 12:24:07.209682       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:24:07.236642       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 26.892992ms
E0823 12:24:07.236823       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:24:45.149235       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:24:45.175769       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 26.472224ms
E0823 12:24:45.175981       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:25:22.920853       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:25:22.945768       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 24.857997ms
E0823 12:25:22.945924       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:26:08.609764       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:26:08.635857       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 26.034407ms
E0823 12:26:08.636020       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:26:52.083808       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:26:52.107763       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 23.894222ms
E0823 12:26:52.107965       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:27:31.447899       1 util.go:232] start proxying: get /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0, in flight requests: 2
I0823 12:27:31.478771       1 util.go:215] yurthub list nodepools: /apis/apps.openyurt.io/v1alpha1/nodepools?limit=500&resourceVersion=0 with status code 403, spent 30.812549ms
E0823 12:27:31.478967       1 reflector.go:178] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1alpha1.NodePool: nodepools.apps.openyurt.io is forbidden: User "system:node:izf8z10d6rdn4eyygywiwwz" cannot list resource "nodepools" in API group "apps.openyurt.io" at the cluster scope
I0823 12:27:35.544620       1 util.go:215] yurthub watch services: /api/v1/services?allowWatchBookmarks=true&resourceVersion=442535&timeout=5m15s&timeoutSeconds=315&watch=true with status code 200, spent 5m15.023730293s
I0823 12:27:35.544701       1 cache_manager.go:277] yurthub watch services: /api/v1/services get 0 objects(add:0/update:0/del:0)
I0823 12:27:35.544845       1 util.go:232] start proxying: get /api/v1/services?allowWatchBookmarks=true&resourceVersion=442535&timeout=8m22s&timeoutSeconds=502&watch=true, in flight requests: 1
...

What you expected to happen:

Yurthub can support k8s 1.20.

How to reproduce it (as minimally and precisely as possible):
Install yurthub and enable resource filter in k8s 1.20 cluster.

Anything else we need to know?:

Environment:

• OpenYurt version: 0.4.1
• Kubernetes version (use kubectl version): 1.20
• OS (e.g: cat /etc/os-release): Centos 7
• Kernel (e.g. uname -a):
• Install tools:
• Others:

others

/kind bug

[SataQiu]

Ref: #426

[rambohe-ch]

@SataQiu Thank you for filing issue.
It's like that yurthub has not enough rbac rights, would you add the list/watch/get nodepools.apps.openyurt.io resource rights for system:nodes group and have a try?

[SataQiu]

Ref: #452
/close

[openyurt-bot]

@SataQiu: Closing this issue.

In response to this:

Ref: #452
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.