Change:
<!-- Please only use this template for submitting reports about continuously failing tests or jobs in Kubernetes CI --Which test(s) are failing: Since when has it been failing: The full testgrid history is red, but it has been failing at least since 5/29 Testgrid link: Reason for failure: Anything else we need to know: Originally these failures were due to an rbac permission issue (see: ), but now that that has been resolved, the tests are still not passing.
/sig network
adding to the milestone for investigation, since ingress was touched this release /milestone v1.19
/triage unresolved Comment when the issue is assessed and confirmed. I am a bot run by vllry. ‍
what is the difference between that job and (which seems to be mostly passing)?
/assign
Also assigning since I think he's already looking into this: /assign
Oh nice, prow can actually assign me now
If this issue has been triaged, please comment . If you aren't able to handle this issue, consider unassigning yourself and/or adding the label. I am a bot run by vllry. ‍
Sorry for the delay. This has been triaged. The actual issue is that: system:controller:glbc rbac needs patch permissions for "ingresses/status" in I will send a PR for the fix. /remove-triage unresolved
^ PR
looks like that resolved almost all the failures. is still failing
Nice! Looks like this failure is caused by relying on the old static IP behavior. We used to allocate one if the specified one did not exist. I will send a PR to update the test.
can we close this out with ?
Yes, latest run was green:
/reopen Can this be reviewed again please? cc
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
seems to be a RBAC issue?
/cc did ingress-gce just start expecting access to this resource recently? does the RBAC role at need to be updated?
Hi, I've filed to address the issue.

Discussion:
- apiGroups: ["extensions", "networking.k8s.io"] resources: ["ingresses"] verbs: ["get", "list", "watch"] <del> # For now, GLBC annotates ingress resources with various state and statuses: </del> <ins> # For now, GLBC annotates ingress resources with various state and statuses: </ins> # https://github.com/kubernetes/ingress-gce/blob/50d49b077d9ab4362a02fae05f94e433cd3f08dc/pkg/controller/controller.go#L579 # TODO(rramkumar1): Remove unnecessary `update` permission once statuses are propagated through `ingresses/status` - apiGroups: ["extensions", "networking.k8s.io"]

- apiGroups: ["extensions", "networking.k8s.io"] resources: ["ingresses/status"] verbs: ["update", "patch"] <del> # GLBC ensures that the `cloud.google.com/backendconfigs` CRD exists in a desired state: # https://github.com/kubernetes/ingress-gce/blob/4918eb2f0f484f09ac9e5a975907a9b16ed2b344/cmd/glbc/main.go#L93 </del> <ins> # GLBC ensures that the `cloud.google.com/backendconfigs` and `networking.gke.io/servicenetworkendpointgroups` CRD exists in a desired state: # https://github.com/kubernetes/ingress-gce/blob/5c3fcb5845e74b92ea8bd52929b15fc5c9fa7970/cmd/glbc/main.go#L108 # https://github.com/kubernetes/ingress-gce/blob/5c3fcb5845e74b92ea8bd52929b15fc5c9fa7970/cmd/glbc/main.go#L133 </ins> # TODO(rramkumar1): https://github.com/kubernetes/ingress-gce/issues/744 - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"]

- apiGroups: ["cloud.google.com"] resources: ["backendconfigs"] verbs: ["get", "list", "watch", "update", "create", "patch"] <ins> - apiGroups: ["networking.gke.io"] resources: ["servicenetworkendpointgroups"] verbs: ["get", "list", "watch", "update", "create", "patch"] </ins>