Having trouble running example

[davidxia]

I get 403 Forbidden when running Example.java. I tried setting KUBECONFIG to the absolute path of my ~/.kube/config file. I'm able to run kubectl get pods --all-namespaces. Is there something I'm missing?

null for gcp
Exception in thread "main" io.kubernetes.client.ApiException: Forbidden
	at io.kubernetes.client.ApiClient.handleResponse(ApiClient.java:882)
	at io.kubernetes.client.ApiClient.execute(ApiClient.java:798)
	at io.kubernetes.client.apis.CoreV1Api.listPodForAllNamespacesWithHttpInfo(CoreV1Api.java:18462)
	at io.kubernetes.client.apis.CoreV1Api.listPodForAllNamespaces(CoreV1Api.java:18440)
	at io.kubernetes.client.examples.Example.main(Example.java:40)

[lwander]

How is your auth setup in your kubeconfig? e.g. are you using certs + basic auth, an auth provider, etc...

[davidxia]

@lwander, my ~/.kube/config looks like

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: ...
    server: https://35.195.200.26
  name: my-cluster
contexts:
- context:
    cluster: my-cluster
    user: my-cluster
  name: my-cluster
current-context: my-cluster
kind: Config
preferences: {}
users:
- name: my-cluster
  user:
    auth-provider:
      config:
        cmd-args: config config-helper --format=json
        cmd-path: /Users/dxia/google-cloud-sdk/bin/gcloud
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp

[lwander]

Thanks - I don't think the client fully supports the gcp authenticator (at the very minimum token refresh isn't implemented). It looks like you're running on GKE, so you could try

gcloud config set container/use_client_certificate True
gcloud container clusters get-credentials my-cluster

To get a credential format the client accepts in the meantime.

[davidxia]

Yes, I am running the example on a GKE cluster. I ran your commands above. kubectl get pods --all-namespaces still works, but Example.java fails with the same error. My ~/.kube/config now looks like.

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: ...
    server: https://35.195.200.26
  name: my-cluster
contexts:
- context:
    cluster: my-cluster
    user: my-cluster
  name: my-cluster
current-context: my-cluster
kind: Config
preferences: {}
users:
- name: my-cluster
  user:
    client-certificate-data: ...
    client-key-data: ...
    password: ...
    username: admin

Am I lacking some IAM permission or RBAC config?

[lwander]

I've seen this happen for another client library with master version greater than 1.8.0 - I'm not sure what the fix is.

[davidxia]

more info. I'm running code from master branch of this repo. kubectl version shows

Client Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.4", GitCommit:"793658f2d7ca7f064d2bdf606519f9fe1229c381", GitTreeState:"clean", BuildDate:"2017-08-17T08:48:23Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"7+", GitVersion:"v1.7.8-gke.0", GitCommit:"a7061d4b09b53ab4099e3b5ca3e80fb172e1b018", GitTreeState:"clean", BuildDate:"2017-10-10T18:48:45Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

[brendandburns]

Can you dump the complete Exception (e.g. exception.getCode() exception.getResponseBody() that will help determine why authorization is failing.

[bergman]

You can get this to work by explicitly calling registerAuthenticator like this:

KubeConfig.registerAuthenticator(new GCPAuthenticator());

[davidxia]

Thanks for the suggestions. I'm running

public class Test {
  public static void main(String[] args) throws Exception {
    KubeConfig.registerAuthenticator(new GCPAuthenticator());
    ApiClient client = Config.defaultClient();
    client.setUsername("dxia");
    Configuration.setDefaultApiClient(client);

    CoreV1Api api = new CoreV1Api();
    try {
      V1PodList list = api.listPodForAllNamespaces(null, null, null, null, null, null, null,
          null, null);
      for (V1Pod item : list.getItems()) {
        System.out.println(item.getMetadata().getName());
      }
    } catch (ApiException e) {
      System.out.println(e);
      System.out.println(e.getCode());
      System.out.println(e.getResponseBody());
    }
  }
}

And I get

io.kubernetes.client.ApiException: Forbidden
403
{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods is forbidden: User \"client\" cannot list pods at the cluster scope: Unknown user \"client\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}

I haven't looked too closely at how to set my username. My kubectl makes the following curl command which only have a bearer token. curl -k -v -XGET -H "Authorization: Basic TOKEN" -H "User-Agent: kubectl/v1.8 .4 (darwin/amd64) kubernetes/9befc2b" -H "Accept: application/json" https://35.224.232.9/api/v1/pods

[bergman]

@davidxia I'm doing something similar to your code except I don't bother with the username and default api client stuff.

I got credentials using gcloud, like so:
gcloud container clusters get-credentials my-cluster --zone europe-west1-d --project my-project-12345

and then this just works:

KubeConfig.registerAuthenticator(new GCPAuthenticator());

final CoreV1Api api = new CoreV1Api(Config.defaultClient());

final int numberOfPods =
    api.listNamespacedPod("default", null, null, null, null, null, null, null, null, null)
        .getItems()
        .size();

System.out.println("numberOfPods = " + numberOfPods);

[davidxia]

@bergman Thanks so much.

This now works for me.

    KubeConfig.registerAuthenticator(new GCPAuthenticator());

    final CoreV1Api api = new CoreV1Api(Config.defaultClient());

    final int numberOfPods =
        api.listPodForAllNamespaces(null, null, null, null, null, null)
            .getItems()
            .size();

    System.out.println("numberOfPods = " + numberOfPods);

gcloud config list shows container/use_v1_api_client = False. My GKE cluster is regional and version 1.8.4-gke.0. My ~/.kube/config looked like

- name: my-cluster
  user:
    auth-provider:
      config:
        access-token: ...
        cmd-args: config config-helper --format=json
        cmd-path: /Users/dxia/google-cloud-sdk/bin/gcloud
        expiry: 2018-01-05T16:44:44Z
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp

[neuromantik33]

Sorry to resurrect this thread but I also can't get the example running on GKE.
Here is my info

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.4", GitCommit:"9befc2b8928a9426501d3bf62f72849d5cbcd5a3", GitTreeState:"clean", BuildDate:"2017-11-20T05:28:34Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"8+", GitVersion:"v1.8.4-gke.1", GitCommit:"04502ae78d522a3d410de3710e1550cfb16dad4a", GitTreeState:"clean", BuildDate:"2017-12-08T17:24:53Z", GoVersion:"go1.8.3b4", Compiler:"gc", Platform:"linux/amd64"}

My config

$ kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: REDACTED
    server: https://35.189.xxx.xxx
  name: gke_my-project_europe-west1-d_test
contexts:
- context:
    cluster: gke_my-project_europe-west1-d_test
    namespace: default
    user: gke_my-project_europe-west1-d_test
  name: gke_my-project_europe-west1-d_test
current-context: gke_my-project_europe-west1-d_test
kind: Config
preferences: {}
users:
- name: gke_my-project_europe-west1-d_test
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
    password: REDACTED
    username: REDACTED

And finally my groovy code

import com.google.protobuf.Api
import io.kubernetes.client.ApiException
import io.kubernetes.client.apis.CoreV1Api
import io.kubernetes.client.models.V1Pod
import io.kubernetes.client.util.Config
import io.kubernetes.client.util.KubeConfig
import io.kubernetes.client.util.authenticators.GCPAuthenticator

KubeConfig.registerAuthenticator(new GCPAuthenticator())

final CoreV1Api api = new CoreV1Api(Config.defaultClient())

try {
    final List<V1Pod> pods =
      api.listNamespacedPod("default",
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null,
                            null)
        .items
    println "pods = $pods"
} catch (ApiException e) {
    println "code = ${e.code}"
    println "headers = ${e.responseHeaders}"
    println "body = ${e.responseBody}"
    e.printStackTrace()
}

With the output being

code = 403
headers = [Audit-Id:[ffe7f738-a484-4b92-986a-92d4e25df98c], Content-Type:[application/json], X-Content-Type-Options:[nosniff], Date:[Tue, 09 Jan 2018 14:29:01 GMT], Content-Length:[245], OkHttp-Sent-Millis:[1515508141825], OkHttp-Received-Millis:[1515508141838]]
body = {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods is forbidden: User \"client\" cannot list pods in the namespace \"default\": Unknown user \"client\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}

Apparently I need to create a user client and grant it a cluster role with list pods? Any help would be much appreciated. Thanks in advance

Nicolas

[brendandburns]

There's something weird going on here. I'd that your complete code? You're not seeing the user any where are you? You shouldn't need to create a 'client' user...

…

--brendan

________________________________ From: Nicolas Estrada <notifications@github.com> Sent: Tuesday, January 9, 2018 6:31:56 AM To: kubernetes-client/java Cc: Brendan Burns; Comment Subject: Re: [kubernetes-client/java] Having trouble running example (#143) Sorry to resurrect this thread but I can't the example running either on GKE. Here is my info $ kubectl version Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.4", GitCommit:"9befc2b8928a9426501d3bf62f72849d5cbcd5a3", GitTreeState:"clean", BuildDate:"2017-11-20T05:28:34Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"8+", GitVersion:"v1.8.4-gke.1", GitCommit:"04502ae78d522a3d410de3710e1550cfb16dad4a", GitTreeState:"clean", BuildDate:"2017-12-08T17:24:53Z", GoVersion:"go1.8.3b4", Compiler:"gc", Platform:"linux/amd64"} My config $ kubectl config view apiVersion: v1 clusters: - cluster: certificate-authority-data: REDACTED server: https://35.189.xxx.xxx name: gke_my-project_europe-west1-d_test contexts: - context: cluster: gke_my-project_europe-west1-d_test namespace: default user: gke_my-project_europe-west1-d_test name: gke_my-project_europe-west1-d_test current-context: gke_my-project_europe-west1-d_test kind: Config preferences: {} users: - name: gke_my-project_europe-west1-d_test user: client-certificate-data: REDACTED client-key-data: REDACTED password: REDACTED username: REDACTED And finally my groovy code import com.google.protobuf.Api import io.kubernetes.client.ApiException import io.kubernetes.client.apis.CoreV1Api import io.kubernetes.client.models.V1Pod import io.kubernetes.client.util.Config import io.kubernetes.client.util.KubeConfig import io.kubernetes.client.util.authenticators.GCPAuthenticator KubeConfig.registerAuthenticator(new GCPAuthenticator()) final CoreV1Api api = new CoreV1Api(Config.defaultClient()) try { final List<V1Pod> pods = api.listNamespacedPod("default", null, null, null, null, null, null, null, null, null) .items println "pods = $pods" } catch (ApiException e) { println "code = ${e.code}" println "headers = ${e.responseHeaders}" println "body = ${e.responseBody}" e.printStackTrace() } With the output being code = 403 headers = [Audit-Id:[ffe7f738-a484-4b92-986a-92d4e25df98c], Content-Type:[application/json], X-Content-Type-Options:[nosniff], Date:[Tue, 09 Jan 2018 14:29:01 GMT], Content-Length:[245], OkHttp-Sent-Millis:[1515508141825], OkHttp-Received-Millis:[1515508141838]] body = {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods is forbidden: User \"client\" cannot list pods in the namespace \"default\": Unknown user \"client\"","reason":"Forbidden","details":{"kind":"pods"},"code":403} Apparently I need to create a user client and grant it a cluster role with list pods? Any help would be much appreciated. Thanks in advance Nicolas — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fkubernetes-client%2Fjava%2Fissues%2F143%23issuecomment-356299933&data=02%7C01%7Cbburns%40microsoft.com%7Cb893a73b24e049e8558508d5576dbce9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636511051190020878&sdata=pzdz%2Bev2W8Y9AryujBjJ9bpxl4oFzGmAJqb1lJE6UyA%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAFfDgjtiq-HmovBCIDFuWrFlZjwckiC-ks5tI3hbgaJpZM4Q6i5k&data=02%7C01%7Cbburns%40microsoft.com%7Cb893a73b24e049e8558508d5576dbce9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636511051190020878&sdata=S25gT9cNPLPOa9Dzyk2BH0ByoI7LssuF2kiLw%2FIqUZ8%3D&reserved=0>.

[neuromantik33]

Ok I figured it out :)
So I noticed that my kubectl uses basic auth to connect to the cluster

$ kubectl get ns -v=7
I0109 18:22:33.143878   27156 loader.go:357] Config loaded from file /home/nestrada/.kube/config
...
I0109 18:22:33.153456   27156 round_trippers.go:414] GET https://35.189.xxx.xxx/api/v1/namespaces
I0109 18:22:33.153463   27156 round_trippers.go:421] Request Headers:
I0109 18:22:33.156114   27156 round_trippers.go:424]     Accept: application/json
I0109 18:22:33.156167   27156 round_trippers.go:424]     User-Agent: kubectl/v1.8.4 (linux/amd64) kubernetes/9befc2b
I0109 18:22:33.156212   27156 round_trippers.go:424]     Authorization: Basic REDACTED
I0109 18:22:33.202874   27156 round_trippers.go:439] Response Status: 200 OK in 46 milliseconds
NAME          STATUS    AGE
default       Active    67d

Yet after digging around in the master branch It seems to have been corrected but not in the 1.0.0-beta1 release. However the correction is not complete. Since my defaultConfig uses basic auth over https, it has a username, password and client certificate but no access token. My workaround was to create one without the factory method.

def username, password, endpoint // Defined elsewhere
def auth = "${username}:${password}".getBytes('ISO-8859-1')
def client = new ApiClient().with {
    basePath = "https://$endpoint"
    verifyingSsl = true
    sslCaCert = getClass().getResourceAsStream('/cluster.cert')
    apiKeyPrefix = 'Basic'
    apiKey = encoder.encodeToString(auth)
    it
}

And it works :)

A more deeper question would be why create many Authentication methods (ApiKeyAuth, HttpBasicAuth, OAuth) if all API calls hardcode the BearerToken key requiring API only?

Anyhow hope this helps anyone else struggling with GKE :)