Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Kubernetes 1.23 - Traefik `ServiceAccount` is unable to list CRDs

See original GitHub issue

What happened:

Hi everyone! I’ve deployed daskhub helm chart to k8s 1.23. I ran into the same error message from https://github.com/dask/dask-gateway/issues/469, so I updated the Traefik CRD and updated the Traefik version to 2.6 by following the changes in this recent commit . I no longer get the Traefik pod error from https://github.com/dask/dask-gateway/issues/469, but now its logging rbac/permission errors related to the Traefik ServiceAccount being unable to list the Traefik CRDs:

Failed to watch *v1alpha1.IngressRouteUDP: failed to list *v1alpha1.IngressRouteUDP: ingressrouteudps.traefik.containo.us is forbidden: User "system:serviceaccount:daskhub:traefik-daskhub-dask-gateway" cannot list resource "ingressrouteudps" in API group "traefik.containo.us" at the cluster scope

Failed to watch *v1alpha1.ServersTransport: failed to list *v1alpha1.ServersTransport: serverstransports.traefik.containo.us is forbidden: User "system:serviceaccount:daskhub:traefik-daskhub-dask-gateway" cannot list resource "serverstransports" in API group "traefik.containo.us" at the cluster scope

This continues for the other Traefik CRDs.

What you expected to happen:

I expected there to be issues trying this out with the latest k8s release. I just wanted to open an issue to track this, and help out with a fix in any way I can!

Anything else we need to know?:

Environment:

Kubernetes: 1.23
- Daskhub helm chart
dask/distributed version: 2022.1.0

Helm Chart values.yaml:

  # The image to use for the proxy pod
  image:
    name: traefik
    tag: 2.6

traefik CRD from https://github.com/dask/dask-gateway/commit/fd77685a592b91fa90c8fe77fee42b154a1144f3
Python version: 3.9
Operating System: Ubuntu 20.04.3 LTS
Install method (conda, pip, source): conda

Issue Analytics

State:
Created 2 years ago
Comments:7 (5 by maintainers)

Top GitHub Comments

1reaction

rigzba21commented, Feb 22, 2022

@consideRatio that worked! Thank you!

1reaction

martindurantcommented, Feb 22, 2022

Ah, of course. Indeed, my testing was against the chart rendered directly from the repo. Thanks for looking into it. So we need a release!!!

Top Results From Across the Web

Kubernetes IngressRoute & Traefik CRD

When using the Traefik Kubernetes CRD Provider, unfortunately Cert-Manager cannot yet interface directly with the CRDs. A workaround is to enable the ...

Ingressclasses not available on namespace scope level #7729

Hi traefik community, After upgrading of k8s cluster to v1.18+ we get ... User "system:serviceaccount:traefik:traefik" cannot list resource ...

Kubernetes API and Feature Removals In 1.22

API removals for Kubernetes v1.22. The v1.22 release will stop serving the API versions we've listed immediately below. These are all ...

Deploying Traefik as Ingress Controller for Your Kubernetes ...

In this tutorial, we will set up Traefik as the Ingress controller in your Kubernetes cluster. To complete examples used below, you'll need...

Install Traefik Ingress Controller in Kubernetes

Note: Traefik is using custom cluster resource definitions. These CRDs gets installed via Traefik 2 Helm Chart. For CRDs schema click here. K8s ......