"can create non-namespaced resources" fails against GKE cluster

[RossVertizan]

Bug Report

What is the issue?

When running the command:
linkerd check --pre

on a Windows 10 machine the "can create non-namespaced resources" check fails with the message:

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version
√ is running the minimum kubectl version

pre-kubernetes-setup
--------------------
√ control plane namespace does not already exist
× can create non-namespaced resources
    cannot create ClusterRole/linkerd-linkerd-identity: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-identity: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-controller: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-controller: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-destination: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-destination: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-web-check: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-web-check: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-web-admin: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-proxy-injector: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-proxy-injector: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-sp-validator: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-sp-validator: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-tap: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-tap-admin: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-tap: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-tap-auth-delegator: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    cannot create ClusterRole/linkerd-linkerd-prometheus: clusterroles.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).
    cannot create ClusterRoleBinding/linkerd-linkerd-prometheus: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[email protected]" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).
    see https://linkerd.io/checks/#pre-k8s-cluster-k8s for hints
√ can create ServiceAccounts
√ can create Services
√ can create Deployments
√ can create CronJobs
√ can create ConfigMaps
√ can create Secrets
√ can read Secrets
√ can read extension-apiserver-authentication configmap
√ no clock skew detected

pre-kubernetes-capability
-------------------------
√ has NET_ADMIN capability
√ has NET_RAW capability

linkerd-version
---------------
√ can determine the latest version
√ cli is up-to-date

Status check results are ×

How can it be reproduced?

I'm not sure if this is a generic way to recreate the problem, because I may have done something else wrong, but all I have done is:

gcloud container clusters create linkerd --num-nodes 3
gcloud compute instances list
gcloud container clusters describe linkerd
linkerd check --pre

Note, that I have not done the extra steps for GKE privtae cluster, when I look at the properties of the cluster in GKE I see that "Private Cluster" is disabled. Also, when running the "gcloud container clusters describe linkerd" command I did not find the "masterIpv4CidrBlock" key.

P.S. It would be good to have a set of Windows Powershell commands in Getting Started instead of just *nix commands.

Logs, error output, etc

Shown above.

linkerd check output

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version
√ is running the minimum kubectl version

linkerd-existence
-----------------
× 'linkerd-config' config map exists
    configmaps "linkerd-config" not found
    see https://linkerd.io/checks/#l5d-existence-linkerd-config for hints

Status check results are ×

Environment

• Kubernetes Version:

PS C:\> kubectl version
Client Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.1", GitCommit:"206bcadf021e76c27513500ca24182692aabd17e", GitTreeState:"clean", BuildDate:"2020-09-09T11:26:42Z", GoVersion:"go1.15", Compiler:"gc", Platform:"windows/amd64"}
Server Version: version.Info{Major:"1", Minor:"15+", GitVersion:"v1.15.12-gke.20", GitCommit:"0ac5f81eecab42bff5ef74f18b99d8896ba7b89b", GitTreeState:"clean", BuildDate:"2020-09-09T00:48:20Z", GoVersion:"go1.12.17b4", Compiler:"gc", Platform:"linux/amd64"}

• Cluster Environment: GKE

• Host OS: Windows 10

• Linkerd version:

PS C:\> linkerd version
Client version: edge-20.9.4
Server version: unavailable

Possible solution

Additional context

[grampelberg]

This is saying that you can't create ClusterRole and ClusterRoleBinding from your user account. You can test this by running:

kubectl auth can-i create clusterrole

You'll want to get that to pass and then linkerd install should work for you! I don't remember all of GKE's IAM, but I suspect you'll want to be a Kubernetes Engine Cluster Admin.

[grampelberg]

Also, we'd love to have powershell commands in the docs! Go check out https://github.com/linkerd/website for the source to all the docs =)