Issue 1:
Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.): NO

What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): deployment delete acl error message

Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT

Kubernetes version (use kubectl version): v1.3.5

Environment:

Cloud provider or hardware configuration: AWS

OS (e.g. from /etc/os-release): CoreOS 899.1.0

Kernel (e.g. uname -a): Linux ip-10-20-8-136.ec2.internal 4.3.3-coreos #2 SMP Thu Dec 17 23:57:55 UTC 2015 x86_64 Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz GenuineIntel GNU/Linux

Install tools: CloudFormation/Ansible

Others:

What happened:

Using kubectl to delete a deployment that is not allowed by ACL blocks for a long time, and eventually prints an unhelpful timed out waiting for the condition. Running it with --v=8 shows a lot of PUT requests being sent repeatedly and getting 403 Forbidden in response.

What you expected to happen:

kubectl should print an error message clearly indicating that this action is not allowed on the first 403.

How to reproduce it (as minimally and precisely as possible):

Create a deployment

Create ACL (ABAC or RBAC) to disallow deleting deployments, but allow reads.

kubectl delete deployment <foo>

After a few minutes, kubectl prints error: timed out waiting for the condition and exits.

Anything else do we need to know:

Issue 2:
Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.):

This is not a request for help.

What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.):

I have searched for these keywords

mac id build

Nothing relevant came up.

The closest relevant issue is: kubernetes build on master branch failed on osx #29247

Is this a BUG REPORT or FEATURE REQUEST? (choose one):

BUG REPORT

Kubernetes version (use kubectl version):

This is a build script bug. I do not know whether the kubectl version would be helpful

The git repo point is

commit 6c5a187

Merge: 364caad 5080a57

Author: Kubernetes Submit Queue k8s-merge-robot@users.noreply.github.com

Date: Thu Sep 29 12:32:08 2016 -0700

Environment:

Cloud provider or hardware configuration:

OS (e.g. from /etc/os-release):

OSx 10.11.6

Kernel (e.g. uname -a):

Darwin mbp-005063 15.6.0 Darwin Kernel Version 15.6.0: Mon Aug 29 20:21:34 PDT 2016; root:xnu-3248.60.11~1/RELEASE_X86_64 x86_64

Install tools:

$ docker --version

Docker version 1.10.3, build 20f81dd

$ docker-machine --version

docker-machine version 0.6.0, build e27fb87

(This is not the latest version of docker, however the build script does not complain with a not-supported error. I presume this combination should still work)

Others:

What happened:

The hack/update-all.sh script fails with the following prompt

(.make/all_go_dirs.mk: Permission denied)

$ hack/update-all.sh -v

Running in short-circuit mode; run with -a to force all scripts to run.

Updating generated-protobuf

+++ [0929 15:04:06] Verifying Prerequisites....

+++ [0929 15:04:06] No docker host is set. Checking options for setting one...

+++ [0929 15:04:06] docker-machine was found.

+++ [0929 15:04:07] A Docker host using docker-machine named 'kube-dev' is ready to go!

+++ [0929 15:04:07] Building Docker image kube-build:build-fb58d75ded

+++ [0929 15:04:07] Running build command....

+++ [0929 15:04:07] Creating data container kube-build-data-fb58d75ded

make: Entering directory '/go/src/k8s.io/kubernetes'

make[1]: Entering directory '/go/src/k8s.io/kubernetes'

hack/make-rules/helpers/cache_go_dirs.sh: line 65: .make/all_go_dirs.mk: Permission denied

find: `./pkg/kubelet/volumemanager/reconciler/pods': Permission denied

rm: cannot remove '.make/all_go_dirs.mk': Permission denied

^CMakefile:287: recipe for target 'generated_files' failed

I have also discovered other scenarios where the permission error is for .make directory.

After a local makeexecution, the update-all.sh script generates a permission error for .make/all_go_dirs.mk.

If one does a make clean && hack/update-all.sh the permission error would be for .make directory.

What you expected to happen:

I expect this to complete without any error.

How to reproduce it (as minimally and precisely as possible):

Checkout the https://github.com/kubernetes/kubernetes.git at 6c5a187 in Mac os with OsX ElCapitan 10.11.6

Use docker version 1.10.3

Go to the root directory of the repo and execute hack/update-all.sh -v

Anything else do we need to know:

In MacOsX with non-native docker, the hack/update-all.sh uses the present docker-machine to launch docker containers.

It compiles the docker run command options like the following:

local -a docker_run_opts=(

"--name=${KUBE_BUILD_CONTAINER_NAME}"

"--user=$(id -u):$(id -g)"

"--hostname=${HOSTNAME}"

"${DOCKER_MOUNT_ARGS[@]}"

)

In kubernetes/build/common.sh file in kube::build::run_build_command() funciton.

This bash script extract runs in the host MacOs machine. That means the id -u and the id -g will be the user's id on the host mac os.

The compiled docker command looks like the following:

docker run --name=kube-build-fb58d75ded --user=980771313:1221986466 --hostname=mbp-005063 --volume

The 980771313:1221986466 user id and the group id are associated with the MacOs in the host.

However the docker run ... command will execute in a vm managed by docker-machine. (In my system the vm's version is kube-dev)

We run this command in the kube-dev vm where the user id looks like the following:

docker@kube-dev:$ id -u

1000

docker@kube-dev:$ id -g

50

I strongly believe that the mismatched user id and the group id between the kube-dev vm and the docker container used to execute the hack/update-all.sh script cause this permission error.