Skip to content
This repository has been archived by the owner on Feb 22, 2021. It is now read-only.

error":"The user doesn't have the required roles!","code":403,"status":"Forbidden #286

Open
jvanathu opened this issue Jul 24, 2019 · 7 comments

Comments

@jvanathu
Copy link

I try to setup using following document . getting error message which i updated in subject line

from this stage , no direction what is missing here ,

curl -X POST http://localhost:8081/environment?_token=$token
-H 'content-type: application/json'
-d '{
"name": "test",
"geoRegion": "us-east-1",
"availability": "staging",
"kubernetesMaster": "http://example.k8s.cluster.com:8080",
"kubernetesNamespace": "default",
"kubernetesToken": "$SECRET_TOKEN",
"servicePortCoefficient": 0
}'

@roiravhon
Copy link
Contributor

Hi @jvanathu, sure you make your user admin?

@jvanathu
Copy link
Author

Yes , i am just using same step , only changed my email id instated of [email protected] . i am using ubuntu , not sure anything with os ?

@jvanathu
Copy link
Author

jvanathu commented Jul 25, 2019 via email

@roiravhon
Copy link
Contributor

roiravhon commented Jul 25, 2019 via email

@roiravhon
Copy link
Contributor

roiravhon commented Jul 28, 2019 via email

@jvanathu
Copy link
Author

after creation of service and deployment , while check the status , getting this error logs

9/07/29 16:49:39.440 [executor126] WARN i.f.k.c.Config: Error reading service account token from: [/var/run/secrets/kubernetes.io/serviceaccount/token]. Ignoring.
apollo_1 | 19/07/29 16:49:39.918 [executor126] WARN i.l.a.c.StatusController: Could not get status of service 1, on environment 1!
apollo_1 | io.fabric8.kubernetes.client.KubernetesClientException: An error has occurred.
apollo_1 | at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:57)
apollo_1 | at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:508)
apollo_1 | at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:62)
apollo_1 | at io.logz.apollo.kubernetes.KubernetesHandler.getKubernetesDeployment(KubernetesHandler.java:482)
apollo_1 | at io.logz.apollo.kubernetes.KubernetesHandler.getCurrentStatus(KubernetesHandler.java:188)
apollo_1 | at io.logz.apollo.kubernetes.KubernetesHandler.getCurrentStatus(KubernetesHandler.java:183)
apollo_1 | at io.logz.apollo.controllers.StatusController.getOneSpecificStatus(StatusController.java:178)
apollo_1 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
apollo_1 | at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
apollo_1 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
apollo_1 | at java.lang.reflect.Method.invoke(Method.java:498)
apollo_1 | at org.rapidoid.http.handler.MethodReqHandler.handleReq(MethodReqHandler.java:51)
apollo_1 | at org.rapidoid.http.handler.AbstractDecoratingHttpHandler.handleReqAndPostProcess(AbstractDecoratingHttpHandler.java:313)
apollo_1 | at org.rapidoid.http.handler.AbstractDecoratingHttpHandler.handleReqMaybeInTx(AbstractDecoratingHttpHandler.java:245)
apollo_1 | at org.rapidoid.http.handler.AbstractDecoratingHttpHandler.access$700(AbstractDecoratingHttpHandler.java:49)
apollo_1 | at org.rapidoid.http.handler.AbstractDecoratingHttpHandler$3.run(AbstractDecoratingHttpHandler.java:211)
apollo_1 | at org.rapidoid.job.PredefinedContextJobWrapper.run(PredefinedContextJobWrapper.java:55)
apollo_1 | at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
apollo_1 | at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
apollo_1 | at java.lang.Thread.run(Thread.java:745)
apollo_1 | Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
apollo_1 | at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
apollo_1 | at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
apollo_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
apollo_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
apollo_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
apollo_1 | at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
apollo_1 | at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
apollo_1 | at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
apollo_1 | at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
apollo_1 | at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
apollo_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
apollo_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
apollo_1 | at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:241)
apollo_1 | at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:198)
apollo_1 | at okhttp3.internal.connection.RealConnection.buildConnection(RealConnection.java:174)
apollo_1 | at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:114)
apollo_1 | at okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:193)
apollo_1 | at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:129)
apollo_1 | at okhttp3.internal.connection.StreamAllocation.newStream(StreamAllocation.java:98)
apollo_1 | at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:42)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
apollo_1 | at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:109)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
apollo_1 | at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
apollo_1 | at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:124)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
apollo_1 | at io.fabric8.kubernetes.client.utils.HttpClientUtils$3.intercept(HttpClientUtils.java:102)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
apollo_1 | at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
apollo_1 | at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:170)
apollo_1 | at okhttp3.RealCall.execute(RealCall.java:60)
apollo_1 | at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:235)
apollo_1 | at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:230)
apollo_1 | at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:506)
apollo_1 | ... 18 common frames omitted
apollo_1 | Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
apollo_1 | at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
apollo_1 | at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
apollo_1 | at sun.security.validator.Validator.validate(Validator.java:260)
apollo_1 | at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
apollo_1 | at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
apollo_1 | at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
apollo_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
apollo_1 | ... 51 common frames omitted
apollo_1 | Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
apollo_1 | at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
apollo_1 | at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
apollo_1 | at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
apollo_1 | at sun.security.validator.PKI

@roiravhon
Copy link
Contributor

Does you kubernetes cluster have a self-signed certificate?
The environment table in Apollo have a field called "kubernetes_ca_cert" you can use to upload your CA certificate, and Apollo will use it when creating the kubernetes client. (make sure to restart apollo after updating it)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants