Can't get it to work on Kube 1.9

I tried to install Ambassador on Minikube with the following config:

$ minikube version
minikube version: v0.25.2

$ kubectl version --short
Client Version: v1.9.2
Server Version: v1.9.4

I follow the getting started guide and deploy it with kubectl apply -f https://getambassador.io/yaml/ambassador/ambassador-rbac.yaml -n=kube-system but then the pods don’t come up:

kubectl logs -c=ambassador ambassador-6fbfcf88c7-m56rt -n=kube-system
./entrypoint.sh: set: line 65: can't access tty; job control turned off
Traceback (most recent call last):
  File "/application/kubewatch.py", line 493, in <module>
    main()
  File "/usr/lib/python3.6/site-packages/click/core.py", line 722, in __call__
    return self.main(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/click/core.py", line 697, in main
    rv = self.invoke(ctx)
  File "/usr/lib/python3.6/site-packages/click/core.py", line 895, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/lib/python3.6/site-packages/click/core.py", line 535, in invoke
    return callback(*args, **kwargs)
  File "/application/kubewatch.py", line 476, in main
    sync(restarter)
  File "/application/kubewatch.py", line 313, in sync
    for x in v1.list_namespaced_config_map(restarter.namespace).items ]
  File "/usr/lib/python3.6/site-packages/kubernetes/client/apis/core_v1_api.py", line 12395, in list_namespaced_config_map
    (data) = self.list_namespaced_config_map_with_http_info(namespace, **kwargs)
  File "/usr/lib/python3.6/site-packages/kubernetes/client/apis/core_v1_api.py", line 12497, in list_namespaced_config_map_with_http_info
    collection_formats=collection_formats)
  File "/usr/lib/python3.6/site-packages/kubernetes/client/api_client.py", line 335, in call_api
    _preload_content, _request_timeout)
  File "/usr/lib/python3.6/site-packages/kubernetes/client/api_client.py", line 148, in __call_api
    _request_timeout=_request_timeout)
  File "/usr/lib/python3.6/site-packages/kubernetes/client/api_client.py", line 371, in request
    headers=headers)
  File "/usr/lib/python3.6/site-packages/kubernetes/client/rest.py", line 250, in GET
    query_params=query_params)
  File "/usr/lib/python3.6/site-packages/kubernetes/client/rest.py", line 240, in request
    raise ApiException(http_resp=r)
kubernetes.client.rest.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Sun, 25 Mar 2018 18:45:53 GMT', 'Content-Length': '280'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"configmaps is forbidden: User \"system:serviceaccount:kube-system:ambassador\" cannot list configmaps in the namespace \"kube-system\"","reason":"Forbidden","details":{"kind":"configmaps"},"code":403}


AMBASSADOR: kubewatch sync exited with status 1
Here's the envoy.json we were trying to run with:
ls: /etc/envoy*.json: No such file or directory
No config generated.
AMBASSADOR: shutting down

Any idea why? I’d like to use it for a gRPC setup.

[rhs]

It’s failing due to a permissions issue. I’m pretty sure we’ve tested on kube 1.9, so it’s likely either a difference due to minikube or possibly a difference due to the fact that you are trying to install it in the kube-system namespace.

Can you try installing it in the default namespace just to help narrow down the possibilities?

[mhausenblas]

Yup, works in a specific NS but still requires cluster-level permissions 😉