Feature Request - RBAC Access about goldpinger

[rapenchukd]

I believe not specifying

        - name: KUBECONFIG
          value: ./kube/config

will default to in cluster (RBAC)

[eahrend]

Testing.

[eahrend]

No longer crashes, however I'm getting this error:

2018/12/13 18:02:34 Metrics setup - see /metrics
2018/12/13 18:02:34 Kubeconfig not specified, trying to use in cluster config
2018/12/13 18:02:34 Added the static middleware
2018/12/13 18:02:34 Added the prometheus middleware
2018/12/13 18:02:34 All good, starting serving the API
2018/12/13 18:02:34 Serving goldpinger at http://[::]:80
2018/12/13 18:03:04 map[100.98.1.18:{10.232.54.249 0xc4207f2e40 Get http://100.98.1.18:80/ping: context deadline exceeded <nil> 500} 100.98.0.27:{10.232.52.216 0xc4205fa377 Get http://100.98.0.27:80/ping: context deadline exceeded <nil> 500} 100.98.1.21:{10.232.54.249 0xc4207f2e49Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500} 100.98.2.18:{10.232.56.228 0xc4207f2bdd Get http://100.98.2.18:80/ping: dial tcp 100.98.2.18:80: connect: connection refused <nil> 500} 100.98.6.17:{10.232.56.202 0xc4207f2c4d Get http://100.98.6.17:80/ping: dialtcp 100.98.6.17:80: connect: connection refused <nil> 500} 100.98.2.21:{10.232.56.228 0xc4207f2d39  0xc4207f4fa0 200} :{10.232.52.216 0xc4207f2dbe  0xc4207f50a0 200} 100.98.6.20:{10.232.56.202 0xc4207f2e09  0xc4207f5140 200}]
2018/12/13 18:04:04 map[100.98.2.21:{10.232.56.228 0xc4205fbee9  0xc42000ac60 200} 100.98.6.20:{10.232.56.202 0xc4207f2f2e  0xc4207f5320 200} 100.98.0.30:{10.232.52.216 0xc4205fbf40 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500} 100.98.1.21:{10.232.54.249 0xc4207f2f37 Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500}]
2018/12/13 18:05:04 map[100.98.0.30:{10.232.52.216 0xc4205fb860 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500} 100.98.2.21:{10.232.56.228 0xc42079e419  0xc4207d2460 200} 100.98.6.20:{10.232.56.202 0xc4205fb82a  0xc4207b8e80 200} 100.98.1.21:{10.232.54.249 0xc42079e500 Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500}]
2018/12/13 18:06:04 map[100.98.1.21:{10.232.54.249 0xc4205fbe67 Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500} 100.98.2.21:{10.232.56.228 0xc4205fbda9  0xc4207b95e0 200} 100.98.6.20:{10.232.56.202 0xc4205fbe5f  0xc4207b9720 200} 100.98.0.30:{10.232.52.216 0xc42079f8e5 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500}]
2018/12/13 18:07:05 map[100.98.2.21:{10.232.56.228 0xc4205fb8b9  0xc4207d31c0 200} 100.98.6.20:{10.232.56.202 0xc4205fb99f  0xc4207d32a0 200} 100.98.0.30:{10.232.52.216 0xc4205fb9b7 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500} 100.98.1.21:{10.232.54.249 0xc4205fb9dd Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500}]
2018/12/13 18:08:05 map[100.98.2.21:{10.232.56.228 0xc42079f969  0xc4207b9440 200} 100.98.6.20:{10.232.56.202 0xc42079f9ef  0xc4207b94e0 200} 100.98.0.30:{10.232.52.216 0xc4205fbd70 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500} 100.98.1.21:{10.232.54.249 0xc4205fbd79 Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500}]
2018/12/13 18:09:05 map[100.98.1.21:{10.232.54.249 0xc42079f7a0 Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500} 100.98.0.30:{10.232.52.216 0xc42079f7a9 Get http://100.98.0.30:80/ping: dial tcp 100.98.0.30:80: i/o timeout <nil> 500} 100.98.2.21:{10.232.56.228 0xc4205fa1ee  0xc4207d22e0 200} 100.98.6.20:{10.232.56.202 0xc42079f76a  0xc4207b90a0 200}]
2018/12/13 18:10:05 map[100.98.1.21:{10.232.54.249 0xc4207f25f0 Get http://100.98.1.21:80/ping: context deadline exceeded <nil> 500} 100.98.2.21:{10.232.56.228 0xc4207f254e  0xc4207a8520 200} 100.98.6.20:{10.232.56.202 0xc4207f259a  0xc4207a85c0 200} 100.98.0.30:{10.232.52.216 0xc4205fa440 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500}]
2018/12/13 18:11:05 map[100.98.6.20:{10.232.56.202 0xc4204b655a  0xc4207b9100 200} 100.98.0.30:{10.232.52.216 0xc4204b6600 Get http://100.98.0.30:80/ping: context deadline exceeded <nil> 500} 100.98.1.21:{10.232.54.249 0xc4204b6609 Get http://100.98.1.21:80/ping: dial tcp 100.98.1.21:80: i/o timeout <nil> 500} 100.98.2.21:{10.232.56.228 0xc42079f75a  0xc4207b9020 200}]

[eahrend]

For more context, our pod IPs are currently:

goldpinger-99hzq                       1/1       Running   0          18m       100.98.0.30 
goldpinger-jm6jz                       1/1       Running   0          18m       100.98.6.20
goldpinger-lxknj                       1/1       Running   0          18m       100.98.1.21   
goldpinger-vbpcw                       1/1       Running   0          18m       100.98.2.21

[seeker89]

Interesting. It seems to be listing the pods correctly, but then noone can reach anyone. What's your networking stack like ?

[eahrend]

As per our discussion via IB, I can't give out the details too much on a public github repo, but we are using a self managed cluster on AWS without a overlay network. I'll do some more digging as to why pods can't reach other pods.

Tried to debug this a bit on my own by exec-ing into the pod but it doesn't look like it has a /bin/bash or /bin/sh. I'll try one of the other existing applications.

[eahrend]

Double checked the logs, it appears we had the daemonset running all nodes, masters included which are turning up the 500 errors.

[seeker89]

From the conversation IRL, it turns out it's about the networking policies. Closing.