Fix errors in configure-multiple-schedulers.md #8540

yujunz · 2018-05-15T06:48:46Z

Failed to push docker image
Errors found in my-scheduler logs

...
E0515 06:36:28.180428       1 reflector.go:205] k8s.io/kubernetes/vendor/k8s.io/client-go/informers/factory.go:130: Failed to list *v1beta1.ReplicaSet: replicasets.extensions is forbidden: User "system:serviceaccount:kube-system:default" cannot list replicasets.extensions at the cluster scope

- Failed to push docker image - Errors found in my-scheduler logs ``` ... E0515 06:36:28.180428 1 reflector.go:205] k8s.io/kubernetes/vendor/k8s.io/client-go/informers/factory.go:130: Failed to list *v1beta1.ReplicaSet: replicasets.extensions is forbidden: User "system:serviceaccount:kube-system:default" cannot list replicasets.extensions at the cluster scope ```

k8sio-netlify-preview-bot · 2018-05-15T06:50:09Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit 7bed674

https://deploy-preview-8540--kubernetes-io-master-staging.netlify.com

Bradamant3 · 2018-05-16T00:44:54Z

/assign

Bradamant3

While we're waiting on tech review, one markup correction please. Thank you!

Bradamant3 · 2018-05-24T12:19:57Z

content/en/docs/tasks/administer-cluster/configure-multiple-schedulers.md

@@ -123,6 +123,14 @@ $ kubectl edit clusterrole system:kube-scheduler
    - update
 ```

+my-scheduler runs as the “default” service account in the “kube-system” namespace. To allow it run with super-user access, grant cluster-admin permissions to the “default” service account in the “kube-system” namespace.


s/"default"/default
s/"kube-system"/kube-system

in other words, replace quotation marks with backticks so that these strings are formatted as code. We use quotation marks in the docs only for strings where strings must be programmatically denoted as such. (There are many violations, but we're trying to clean up ;) )

Bradamant3 · 2018-05-30T13:23:17Z

/approve for doc review

@kubernetes/sig-scheduling-pr-reviews are y'all the right ones for tech review?

k8s-ci-robot · 2018-05-30T13:23:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Bradamant3

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Bradamant3]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tengqm · 2018-05-31T02:14:12Z

content/en/docs/tasks/administer-cluster/configure-multiple-schedulers.md

+``` shell
+kubectl create clusterrolebinding my-scheduler-cluster-admin \
+  --clusterrole=cluster-admin \
+  --serviceaccount=kube-system:default


curious why we are not using the system:kube-scheduler clusterole?

In general, you should not give elevated privileges of cluster-admin to default unless absolutely needed. Did you add my-scheduler to resourceNames of kube-scheduler clusterrole?

Yes, added. And I also agree that binding cluster-admin is not a good idea.

Changed to system:kube-scheduler

ravisantoshgudimetla · 2018-05-31T02:40:57Z

content/en/docs/tasks/administer-cluster/configure-multiple-schedulers.md

@@ -44,7 +44,7 @@ For more details, please read the GCR
 [documentation](https://cloud.google.com/container-registry/docs/).

 ```shell
-docker build -t my-kube-scheduler:1.0 .
+docker build -t gcr.io/my-gcp-project/my-kube-scheduler:1.0 .


Not sure, if you are pushing it to google cloud container registry. If you are pushing to google container registry the build command seems correct.

The next line in the document is $ gcloud docker -- push gcr.io/my-gcp-project/my-kube-scheduler:1.0

It will result in the following error:

The push refers to repository [gcr.io/my-gcp-project/my-kube-scheduler] An image does not exist locally with the tag: gcr.io/my-gcp-project/my-kube-scheduler

Bradamant3 · 2018-06-01T17:54:51Z

@tengqm does this look OK now?

tengqm · 2018-06-03T12:34:06Z

content/en/docs/tasks/administer-cluster/configure-multiple-schedulers.md

+``` shell
+kubectl create clusterrolebinding my-scheduler-kube-scheduler \
+  --clusterrole=system:kube-scheduler \
+  --serviceaccount=kube-system:default


This could work but ... it is creating another security issue. I'm not a fan of changing the built in accounts. Instead I'd suggest we create a new service account for this.

tengqm · 2018-06-04T15:03:34Z

content/en/docs/tasks/administer-cluster/my-scheduler.yaml

+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-scheduler


this is a valid service account name, though ... funny

tengqm

/lgtm

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels May 15, 2018

k8s-ci-robot requested review from davidopp and madhusudancs May 15, 2018 06:48

k8s-ci-robot assigned Bradamant3 May 16, 2018

Bradamant3 suggested changes May 24, 2018

View reviewed changes

Replace double quote with backticks for code strings

5d6c98e

Bradamant3 approved these changes May 30, 2018

View reviewed changes

k8s-ci-robot added the sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. label May 30, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 30, 2018

tengqm reviewed May 31, 2018

View reviewed changes

ravisantoshgudimetla reviewed May 31, 2018

View reviewed changes

Use system:kube-scheduler instead of cluster-admin

746cdc4

zacharysarah added the Docs Review: Open Issues label May 31, 2018

tengqm reviewed Jun 3, 2018

View reviewed changes

yujunz force-pushed the patch-1 branch 3 times, most recently from bd5504a to 32a6784 Compare June 4, 2018 08:43

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 4, 2018

Create dedicated service account for my-scheduler

0fa6626

yujunz force-pushed the patch-1 branch from 32a6784 to 0fa6626 Compare June 4, 2018 08:47

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 4, 2018

Merge remote-tracking branch 'upstream/master' into patch-1

7bed674

yujunz force-pushed the patch-1 branch from 47a0cd4 to 7bed674 Compare June 4, 2018 09:06

tengqm reviewed Jun 4, 2018

View reviewed changes

k8s-ci-robot assigned tengqm Jun 4, 2018

tengqm reviewed Jun 4, 2018

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 4, 2018

k8s-ci-robot merged commit d037453 into kubernetes:master Jun 4, 2018

yujunz deleted the patch-1 branch June 5, 2018 01:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix errors in configure-multiple-schedulers.md #8540

Fix errors in configure-multiple-schedulers.md #8540

yujunz commented May 15, 2018 •

edited

Loading

k8sio-netlify-preview-bot commented May 15, 2018 •

edited

Loading

Bradamant3 commented May 16, 2018

Bradamant3 left a comment

Bradamant3 May 24, 2018

yujunz May 25, 2018

Bradamant3 commented May 30, 2018

k8s-ci-robot commented May 30, 2018

tengqm May 31, 2018

ravisantoshgudimetla May 31, 2018

yujunz May 31, 2018

ravisantoshgudimetla May 31, 2018

yujunz May 31, 2018

Bradamant3 commented Jun 1, 2018

tengqm Jun 3, 2018

tengqm Jun 4, 2018

tengqm left a comment

Fix errors in configure-multiple-schedulers.md #8540

Fix errors in configure-multiple-schedulers.md #8540

Conversation

yujunz commented May 15, 2018 • edited Loading

k8sio-netlify-preview-bot commented May 15, 2018 • edited Loading

Bradamant3 commented May 16, 2018

Bradamant3 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Bradamant3 commented May 30, 2018

k8s-ci-robot commented May 30, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Bradamant3 commented Jun 1, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tengqm left a comment

Choose a reason for hiding this comment

yujunz commented May 15, 2018 •

edited

Loading

k8sio-netlify-preview-bot commented May 15, 2018 •

edited

Loading