I’m trying to deploy Kubernetes Web UI as described here: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
My system configuration is as follows:
$ uname -a Linux debian 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64 GNU/Linux $ /usr/bin/qemu-system-x86_64 --version QEMU emulator version 3.1.0 (Debian 1:3.1+dfsg-8+deb10u3) Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers $ minikube version minikube version: v1.5.2 commit: 792dbf92a1de583fcee76f8791cff12e0c9440ad-dirty $ kubectl version Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.3", GitCommit:"b3cbbae08ec52a7fc73d334838e18d17e8512749", GitTreeState:"clean", BuildDate:"2019-11-13T11:23:11Z", GoVersion:"go1.12.12", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:09:08Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}
After starting the minukube cluster minikube start
I created a Service Account and ClusterRoleBinding as described here: https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md
$ nano dashboard-adminuser.yaml
apiVersion: v1 kind: ServiceAccount metadata: name: admin-user namespace: kubernetes-dashboard
$ kubectl apply -f dashboard-adminuser.yaml $ nano dashboard-adminuser.yaml
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: admin-user roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: admin-user namespace: kubernetes-dashboard
$ kubectl apply -f dashboard-adminuser.yaml
Now I execute:
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta6/aio/deploy/recommended.yaml
or
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended.yaml
and get the following output:
namespace/kubernetes-dashboard configured serviceaccount/kubernetes-dashboard configured service/kubernetes-dashboard configured secret/kubernetes-dashboard-certs configured secret/kubernetes-dashboard-csrf configured secret/kubernetes-dashboard-key-holder configured configmap/kubernetes-dashboard-settings configured role.rbac.authorization.k8s.io/kubernetes-dashboard configured clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard configured rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard configured deployment.apps/kubernetes-dashboard configured service/dashboard-metrics-scraper configured deployment.apps/dashboard-metrics-scraper configured The ClusterRoleBinding "kubernetes-dashboard" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"ClusterRole", Name:"kubernetes-dashboard"}: cannot change roleRef
What happened and how to fix it?
Advertisement
Answer
issue is you missed this note :
NOTE: apiVersion of ClusterRoleBinding resource may differ between Kubernetes versions.
Prior to Kubernetes v1.8 the apiVersion was rbac.authorization.k8s.io/v1beta1.
This should solve this problem.
Edit1:
this issue talks about same problem. specifically this comment. talks about
Role bindings are immutable
Cause here is
dashboard-adminuser.yaml
sets roleRef.
and
yaml file you are applying later has roleRef in same namespace.
apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: kubernetes-dashboard subjects: - kind: ServiceAccount name: kubernetes-dashboard namespace: kubernetes-dashboard