https://outerbounds.com/ logo
Join Slack
Powered by
Hi everybody. I am trying to schedule a flow with ...
# ask-metaflow
e
Hi everybody. I am trying to schedule a flow with Argo and Kubernetes. Even the most simple flows do not work. I am getting always the same error: "Error (exit code 1): pods "testsdebug-blhsc-989916586" is forbidden: User "systemserviceaccountdefault:ksa-metaflow" cannot patch resource "pods" in API group "" in the namespace "default" "
✅ 1
f
The service account 
ksa-metaflow
needs more privileges. If it's a test environment, you can simply grant "cluster admin" privileges:
Copy code
kubectl create rolebinding metaflow-admin --clusterrole=admin --serviceaccount=default:ksa-metaflow
e
Could it be a problem with the namespace? It should be set to "argo" no?
f
I usually have the 
cluster install
 and run my flows in the 
default
namespace
you can try to run flows in the 
argo
namespace
m
you'll need to set up a service account with the appropriate role to run workflows.
Copy code
apiVersion: <http://rbac.authorization.k8s.io/v1|rbac.authorization.k8s.io/v1>
kind: ClusterRole
metadata:
  name: workflow-user-role
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - watch
- apiGroups:
  - ""
  resources:
  - pods/log
  verbs:
  - get
  - watch
- apiGroups:
  - <http://argoproj.io|argoproj.io>
  resources:
  - workflows
  verbs:
  - get
  - create
- apiGroups:
  - <http://argoproj.io|argoproj.io>
  resources:
  - workflowtaskresults
  verbs:
  - create
This is the role we use in our cluster. We assign it to our different service accounts and then specify the service account in the workflow
👍 1
Also, not sure what version of argo you are on, but the requirement for pod patch permissions was removed. It is no longer required.
e
I follow all the instructions from the Outerbounds template. I deployed MetaFlow on GCP using the Terraform template.
f
wow, I was too lazy to figure out a minimal set of permissions. Thanks for sharing
e
Those are the steps in the instructions:
Copy code
STEP 3.1: 
<https://argoproj.github.io/argo-workflows/quick-start/#install-argo-workflows>
$ kubectl apply -n argo -f <https://github.com/argoproj/argo-workflows/releases/download/v3.3.10/install.yaml>
$ kubectl patch deployment \
  argo-server \
  --namespace argo \
  --type='json' \
  -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/args", "value": [
  "server",
  "--auth-mode=server"
]}]'
m
looks like it taken from this page
https://argoproj.github.io/argo-workflows/quick-start/#submitting-an-example-workflow - looks like you need to run the workflow in argo for this example
when going to production you'd likely want separate namespaces and set up the proper RBAC etc
e
Thanks @mammoth-rainbow-82717 I will have a look at your suggestions and get back to you.
Open in Slack
PreviousNext
Powered by