Istio Ingress cannot update ingresses/status with RBAC enabled #329
Description
Seeing the following when running through the installation tutorial
I've run:
kubectl apply -f install/kubernetes/istio-rbac-beta.yaml
kubectl apply -f install/kubernetes/istio-auth.yaml
- k8s 1.6.4
- RBAC enabled
W0526 07:39:30.405791 1 status.go:306] error updating ingress rule: User "system:serviceaccount:default:istio-ingress-service-account" cannot update ingresses.extensions/status in the namespace "default". (put ingresses.extensions gateway)
I believe you need to update the resources under the apiGroups extensions in the ClusterRole to include "ingresses/status" (see below). Happy to submit a PR if you think this is valid.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: {{ $serviceName }}-manager
rules:
- apiGroups: ["istio.io"]
resources: ["istioconfigs", "istioconfigs.istio.io"]
verbs: ["*"]
- apiGroups: ["extensions"]
resources: ["thirdpartyresources", "thirdpartyresources.extensions", "ingresses", "ingresses/status"]
verbs: ["*"]
- apiGroups: [""]
resources: ["configmaps", "endpoints", "pods", "services"]
verbs: ["*"]