---- ------ ---- ---- ------- Warning FailedScheduling 42s (x85 over 56m) default-scheduler 0/1 nodes are available: 1 Insufficient cpu 

You also might get an role-based access control (RBAC) error based on lack of permissions to a resource within Kubernetes. If you get this, make sure that you satisfy all the prerequisites for installing the console. Focus on checking that you have created all necessary clusterroles, roles, clusterrolebindings, rolebindings, and pod security policies. 

kubectl get pods redbook-team00-ibp-console-78b77b676d-68cnn NAME READY STATUS RESTARTS AGE redbook-team00-ibp-console-78b77b676d-68cnn 4/5 CrashLoopBackOff 5 3m58s kubectl logs redbook-team00-ibp-console-78b77b676d-68cnn -c operator {"level":"error","ts":1567087886.392721,"logger":"k8sutil","msg":"Failed to get Pod","Pod.Namespace":"redbook-team00","Pod.Name":"redbook-team00-ibp-console-78b77b676d-68cnn","error":"pod s "redbook-team00-ibp-console-78b77b676d-68cnn" is forbidden: User "system:serviceaccount:redbook-team00:ibp" cannot get resource "pods" in API group "" in the namespace "redbook-team00"" 

## 4.5.2 Troubleshooting blockchain component installation 

The commands in Example 4-29 show how to grep errors for blockchain components. 

$ kubectl logs orderingserviceca-c4d577476-z88px --all-containers -n redbook-team00 | grep -i ERROR $ kubectl logs org1ca-66d5848fc8-5nvb9 --all-containers -n redbook-team00 | grep -i ERROR $ kubectl logs org2ca-5d6bd5d8b4-8wx8k --all-containers -n redbook-team00 | grep -i ERROR 

## Common errors 

Here are some common errors that you might see for IBP installation: 

GLYPH<SM590000> Need more permissive PodSecurity policy . Example 4-30 shows this error, which deals with Certificate Authority component permissions. 

$kubectl get events LAST SEEN TYPE REASON KIND MESSAGE 9s Warning FailedCreate ReplicaSet Error creating: pods "peer1ca-846fcbf996-" is forbidden: unable to validate against any pod security policy: [spec.initContainers[0].securityContext.runAsNonRoot: Invalid value: false: must be true spec.initContainers[0].securityContext.capabilities.add: Invalid value: "CHOWN": capability may not be added spec.initContainers[0].securityContext.capabilities.add: Invalid value: "FOWNER": capability may not be added spec.containers[0].securityContext.capabilities.add: Invalid value: "NET_BIND_SERVICE": capability may not be added] 54s Normal ExternalProvisioning PersistentVolumeClaim waiting for a volume to be created, either by external provisioner "nfs-provisioner" or manually created by system administrator 

GLYPH<SM590000> Insufficient memory allo cation in Peer pod causes DinD container to fail as shown in Example 4-31. 

Example 4-31 DinD container memory allocation error 

