How do you set the namespace in a spring boot/cloud application?

[csmithmtb]

I included the spring-cloud-starter-kubernates dependency in my pom. Added a configmap for the application. However, when I look at the logs, it appears that KubernetesClient isn't picking up the namespace, default, in which the container is running.

I tried to set spring.cloud.kubernetes.config.namespace equal to "default" but the KubernetesClient still doesn't seem to have the namespace.

Error:
[ main] i.f.s.c.k.c.ConfigMapPropertySource : Can't read configMap with name: [test-merchant-service] in namespace:[null]. Ignoring

[iocanel]

@csmithmtb: The most common way to set the namespace is to add it as env variable:

      - name: "KUBERNETES_NAMESPACE"
        valueFrom:
          fieldRef:
            fieldPath: "metadata.namespace"

I think that at some point kubernetes provides a more elegant way of letting pods know, which is the correct namespace (and with later versions of kubernetes it should just work).

Now, regarding spring.cloud.kubernetes.config.namespace this property is expected to generally work, but I am not 100% sure myself if its possible to use one property source to configure an other.

If spring boot supports reading .properties or .yaml files to configure an other property source (e.g. configmap) then we definitely need to fix it.

[christian-posta]

So why does this one need to be reopened @iocanel ?

[iocanel]

Mostly because I closed it by accident :-)

We need to come with an answer to the question "is it possible to specify a custom for the configmap property source?". I think that it should be possible via bootstrap properties, but until we get it documented, I am keepin it open.

[jorgemoralespou]

@iocanel I'm getting the same exception, although I'm using the downwardAPI to set the namespace as you explain in the previous comment.
I'm using Origin 1.3.0

[jorgemoralespou]

@iocanel And then I have noticed that the namespace is properly set, since I can see a following trace:
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://kubernetes.default.svc/api/v1/namespaces/myproject/pods/parksmap-3-t6i0a. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked.

[iocanel]

The last exception you get is a permission issue. You could work fix this by setting the correct service account to your pod, (one that has permission to access the api server).

[iocanel]

Also , you mentioned that you get the same exception as before. Is that correct?

[jorgemoralespou]

@iocanel yes, both traces are in the same output. The serviceaccount used is default, so should have permissions to query for pods in my namespace. Not sure if this has been a change in origin 1.3.0, but the code used to work.
Funny enough, if I run the springboot outside my cluster, in standalone mode, it will connect to the configmap and not show any trace.
To be honest, I don't know there the second trace is coming from, as I'm just trying to autowire a config property.

[iocanel]

@jorgemoralespou: I'm pretty positive that this is a permission issue with the service account, but I want to try to reproduce it myself. Can you please provide some more details about your installation? like os? installation steps? or anything else that might be useful. (e.g. I use fedora, installed the openshift binaries locally and then used setup things using gofabric8)

[jorgemoralespou]

@iocanel once I push my app to github, I'll give you all the details.
Thanks,

[christian-posta]

What happens if you add the edit policy to your default service account?

On Thursday, September 22, 2016, Jorge Morales Pou [email protected]
wrote:

@iocanel https://github.com/iocanel once I push my app to github, I'll
give you all the details.
Thanks,

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#35 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AADP0W19jFZulM4700ZBokAzX_rQRj6nks5qslAZgaJpZM4JBmIB
.

Christian Posta
twitter: @christianposta
http://www.christianposta.com/blog
http://fabric8.io

[jorgemoralespou]

@christian-posta it works, but Why would I need to add edit role to the serviceaccount?
Maybe that's a change in permissions on the endpoint in OpenShift side.

I swear this was working on a previous version, and not only that, but when I run it locally it works, so for me, not nice.

[christian-posta]

What do you mean locally? As in run the app outside of openshift and still query the kube api?
spring-cloud-kubernetes will try to lookup the configmap, etc using the
kubernetes API and if you're already logged in to a kubernetes cluster and
have access to the API (via kubectl/oc and your context is set up in
~/.kube/config) then you'll already be authenticated and the calls will
work.

OpenShift has LOTS of security "features" unfortunately for OOTB developer
use cases it's a bit restrictive.

You can try fiddle around with other policy roles to add instead of edit
that allow you to access the API using the default service account.

HTH!

On Thu, Sep 22, 2016 at 6:37 AM, Jorge Morales Pou <[email protected]

wrote:

@christian-posta https://github.com/christian-posta it works, but Why
would I need to add edit role to the serviceaccount?
Maybe that's a change in permissions on the endpoint in OpenShift side.

I swear this was working on a previous version, and not only that, but
when I run it locally it works, so for me, not nice.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#35 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AADP0XSfJJF9yB2mCLAW8F4FO-Hweiv1ks5qsoSjgaJpZM4JBmIB
.

Christian Posta
twitter: @christianposta
http://www.christianposta.com/blog
http://fabric8.io

[jorgemoralespou]

@christian-posta yeah, locally as in my local laptop. I've learned that the default serviceaccount as no role whatsoever but just image-puller. Hence the need to add it when running in openshift as the deployment is done with the default serviceaccount, whilst when run in my laptop it will use my credentials, form .kube where I'm using some credentials that have admin roles, hence it works.
Also, learned that this upstream proposal: kubernetes/kubernetes#31441 will make our live as devs easier.

thanks Christian

[RobinsChens]

how can I choose spring-cloud demo from fabric-devops

[shoaibjdev]

Adding below environment variables to pods doesn't help in kubernetes v 1.5.2

• name: "KUBERNETES_NAMESPACE"
  valueFrom:
  fieldRef:
  fieldPath: "metadata.namespace"

Any other suggestions for this error ?

12:42:08.615 [OkHttp https://kubernetes.default.svc/...] WARN i.f.s.c.k.c.ConfigMapPropertySource - Can't read configMap with name: [my-boot-service] in namespace:[null]. Ignoring

[iocanel]

I think that after a specific version of kubernetes, this has become obsolete as the namespace is read from /*var*/*run*/*secrets*/*kubernetes*. *io*/serviceaccount/*namespace.* So, this seems like a bug.

…

On Tue, Jan 30, 2018 at 2:59 PM, Shoaib R Khan ***@***.***> wrote: Adding below environment variables to pods doesn't help in kubernetes v 1.5.2 - name: "KUBERNETES_NAMESPACE" valueFrom: fieldRef: fieldPath: "metadata.namespace" Any other suggestions for this error ? 12:42:08.615 [OkHttp https://kubernetes.default.svc/...] WARN i.f.s.c.k.c.ConfigMapPropertySource - Can't read configMap with name: [my-boot-service] in namespace:[null]. Ignoring — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#35 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAYiWNWGiKaxzRJIJIxKEl1jXswwuuKEks5tPxJKgaJpZM4JBmIB> .

-- *Ioannis Canellos* *Blog: http://iocanel.blogspot.com <http://iocanel.blogspot.com/>* *Twitter: iocanel*

[iocanel]

@ravening: The project has moved to: https://github.com/spring-cloud/spring-cloud-kubernetes please raise any issues discussions there.

[ravening]

@ravening: The project has moved to: https://github.com/spring-cloud/spring-cloud-kubernetes please raise any issues discussions there.

Ok. I deleted the comment