<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.): NO</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): deployment delete acl error message</p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one): BUG REPORT</p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>): v1.3.5</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: AWS</li>
<li><strong>OS</strong> (e.g. from /etc/os-release): CoreOS 899.1.0</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>): <code class="notranslate">Linux ip-10-20-8-136.ec2.internal 4.3.3-coreos #2 SMP Thu Dec 17 23:57:55 UTC 2015 x86_64 Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz GenuineIntel GNU/Linux</code></li>
<li><strong>Install tools</strong>: CloudFormation/Ansible</li>
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>:<br>
Using kubectl to delete a deployment that is not allowed by ACL blocks for a long time, and eventually prints an unhelpful <code class="notranslate">timed out waiting for the condition</code>. Running it with <code class="notranslate">--v=8</code> shows a lot of <code class="notranslate">PUT</code> requests being sent repeatedly and getting 403 Forbidden in response.</p>
<p dir="auto"><strong>What you expected to happen</strong>:<br>
kubectl should print an error message clearly indicating that this action is not allowed on the first 403.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<ol dir="auto">
<li>Create a deployment</li>
<li>Create ACL (ABAC or RBAC) to disallow deleting deployments, but allow reads.</li>
<li><code class="notranslate">kubectl delete deployment &lt;foo&gt;</code></li>
<li>After a few minutes, kubectl prints <code class="notranslate">error: timed out waiting for the condition</code> and exits.</li>
</ol>
<p dir="auto"><strong>Anything else do we need to know</strong>:</p>
<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.):</p>
<p dir="auto">This is not a request for help.</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.):</p>
<p dir="auto">I have searched for these keywords<br>
mac id build<br>
Nothing relevant came up.<br>
The closest relevant issue is: kubernetes build on master branch failed on osx <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="166481461" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/29247" data-hovercard-type="issue" data-hovercard-url="/kubernetes/kubernetes/issues/29247/hovercard" href="https://github.com/kubernetes/kubernetes/issues/29247">#29247</a></p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one):</p>
<p dir="auto">BUG REPORT</p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):</p>
<p dir="auto">This is a build script bug. I do not know whether the kubectl version would be helpful<br>
The git repo point is</p>
<p dir="auto">commit <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/kubernetes/kubernetes/commit/6c5a18717137b3227644bccbdcdd8890b887934b/hovercard" href="https://github.com/kubernetes/kubernetes/commit/6c5a18717137b3227644bccbdcdd8890b887934b"><tt>6c5a187</tt></a><br>
Merge: <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/kubernetes/kubernetes/commit/364caad0f0ca3df33c02bdba05d537a94c668129/hovercard" href="https://github.com/kubernetes/kubernetes/commit/364caad0f0ca3df33c02bdba05d537a94c668129"><tt>364caad</tt></a> <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/kubernetes/kubernetes/commit/5080a575ad0c7c8f85f5cf5f293db6f5dce91663/hovercard" href="https://github.com/kubernetes/kubernetes/commit/5080a575ad0c7c8f85f5cf5f293db6f5dce91663"><tt>5080a57</tt></a><br>
Author: Kubernetes Submit Queue <a href="mailto:k8s-merge-robot@users.noreply.github.com">k8s-merge-robot@users.noreply.github.com</a><br>
Date:   Thu Sep 29 12:32:08 2016 -0700</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>:</li>
<li><strong>OS</strong> (e.g. from /etc/os-release):<br>
OSx 10.11.6</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):<br>
Darwin mbp-005063 15.6.0 Darwin Kernel Version 15.6.0: Mon Aug 29 20:21:34 PDT 2016; root:xnu-3248.60.11~1/RELEASE_X86_64 x86_64</li>
<li><strong>Install tools</strong>:</li>
</ul>
<p dir="auto">$ docker --version<br>
Docker version 1.10.3, build 20f81dd<br>
$ docker-machine --version<br>
docker-machine version 0.6.0, build e27fb87</p>
<p dir="auto">(This is not the latest version of docker, however the build script does not complain with a not-supported error. I presume this combination should still work)</p>
<ul dir="auto">
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>:</p>
<p dir="auto">The hack/update-all.sh script fails with the following prompt<br>
(.make/all_go_dirs.mk: Permission denied)</p>
<p dir="auto">$ hack/update-all.sh  -v<br>
Running in short-circuit mode; run with -a to force all scripts to run.<br>
Updating generated-protobuf<br>
+++ [0929 15:04:06] Verifying Prerequisites....<br>
+++ [0929 15:04:06] No docker host is set. Checking options for setting one...<br>
+++ [0929 15:04:06] docker-machine was found.<br>
+++ [0929 15:04:07] A Docker host using docker-machine named 'kube-dev' is ready to go!<br>
+++ [0929 15:04:07] Building Docker image kube-build:build-fb58d75ded<br>
+++ [0929 15:04:07] Running build command....<br>
+++ [0929 15:04:07] Creating data container kube-build-data-fb58d75ded<br>
make: Entering directory '/go/src/k8s.io/kubernetes'<br>
make[1]: Entering directory '/go/src/k8s.io/kubernetes'<br>
hack/make-rules/helpers/cache_go_dirs.sh: line 65: .make/all_go_dirs.mk: Permission denied<br>
find: `./pkg/kubelet/volumemanager/reconciler/pods': Permission denied<br>
rm: cannot remove '.make/all_go_dirs.mk': Permission denied<br>
^CMakefile:287: recipe for target 'generated_files' failed</p>
<p dir="auto">I have also discovered other scenarios where the permission error is for .make directory.<br>
After a local <code class="notranslate">make</code>execution, the update-all.sh script generates a permission error for .make/all_go_dirs.mk.<br>
If one does a <code class="notranslate">make clean &amp;&amp; hack/update-all.sh</code> the permission error would be for .make directory.</p>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<p dir="auto">I expect this to complete without any error.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<p dir="auto">Checkout the <a href="https://github.com/kubernetes/kubernetes.git">https://github.com/kubernetes/kubernetes.git</a> at <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/kubernetes/kubernetes/commit/6c5a18717137b3227644bccbdcdd8890b887934b/hovercard" href="https://github.com/kubernetes/kubernetes/commit/6c5a18717137b3227644bccbdcdd8890b887934b"><tt>6c5a187</tt></a> in Mac os with OsX ElCapitan 10.11.6</p>
<p dir="auto">Use docker version 1.10.3<br>
Go to the root directory of the repo and execute <code class="notranslate">hack/update-all.sh -v</code></p>
<p dir="auto"><strong>Anything else do we need to know</strong>:</p>
<p dir="auto">In MacOsX with non-native docker, the hack/update-all.sh uses the present docker-machine to launch docker containers.<br>
It compiles the docker run command options like the following:</p>
<p dir="auto">local -a docker_run_opts=(<br>
"--name=${KUBE_BUILD_CONTAINER_NAME}"<br>
"--user=$(id -u):$(id -g)"<br>
"--hostname=${HOSTNAME}"<br>
"${DOCKER_MOUNT_ARGS[@]}"<br>
)<br>
In kubernetes/build/common.sh file  in kube::build::run_build_command() funciton.</p>
<p dir="auto">This bash script extract runs in the host MacOs machine. That means the id -u and the id -g will be the user's id on the host mac os.</p>
<p dir="auto">The compiled docker command looks like the following:</p>
<p dir="auto">docker run --name=kube-build-fb58d75ded --user=980771313:1221986466 --hostname=mbp-005063 --volume</p>
<p dir="auto">The 980771313:1221986466 user id and the group id are associated with the MacOs in the host.</p>
<p dir="auto">However the <code class="notranslate">docker run ...</code> command will execute in a vm managed by docker-machine. (In my system the vm's version is kube-dev)</p>
<p dir="auto">We run this command in the kube-dev vm where the user id looks like the following:<br>
docker@kube-dev:<del>$ id -u<br>
1000<br>
docker@kube-dev:</del>$ id -g<br>
50</p>
<p dir="auto">I strongly believe that the mismatched user id and the group id between the kube-dev vm and the docker container used to execute the hack/update-all.sh script cause this permission error.</p>