RBAC permissions wider than needed about registry-creds HOT 12 CLOSED

This line:

Causes the CM to never get created with an error in the controller logs:

error initially creating leader election record: configmaps is forbidden:
User "system:serviceaccount:registry-creds-system:default" cannot create resource "configmaps" in API group "" in the namespace
 "registry-creds-system"

I've had to remove

from registry-creds.

I agree. I think this was introduced by a community PR. Happy to take a PR @sarahhodne

from registry-creds.

@sarahhodne thanks for your feedback, did you want to do the PR yourself?

from registry-creds.

/add labels: good first issue,skill/beginner,help wanted

from registry-creds.

I'm a volunteer for this issue.

from registry-creds.

I probably won't have time to look at it for a bit, sorry, so feel free to work on this. Here's the roles we actually ended up using and got to work:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: registry-creds
rules:
- apiGroups: [""]
  resources: [namespaces]
  verbs: [get, list, watch]
- apiGroups: [""]
  resources: [secrets]
  verbs: [create, get, list, watch]
- apiGroups: [""]
  resources: [serviceaccounts]
  verbs: [get, list, patch, update, watch]
- apiGroups: [ops.alexellis.io]
  resources: [clusterpullsecrets]
  verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: registry-creds
rules:
- apiGroups: [""]
  resources: [configmaps, events]
  verbs: [create]
- apiGroups: [""]
  resourceNames: [8bdecb1a.alexellis.io]
  resources: [configmaps]
  verbs: [get, patch, update]

from registry-creds.

I'll test and check if it works properly with these roles. 👍

from registry-creds.

@mylesagray on what Kubernetes version? It works fine for me with K8s 1.21.

from registry-creds.

@alexellis every one i've tested it on - IIRC from around v1.18 on, both self built vanilla K8s and Tanzu K8s distros. Fresh cluster install - apply the manifest in the repo and it won't work until that static resource name is removed - it looks like it's generated on apply?

from registry-creds.

@mylesagray I can't reproduce any issue with KinD 1.18 or 1.21.1

Perhaps this is a specific support request that only affects VMware Tanzu users?

How about you raise your own issue with a detailed repro and error messages / logs?

Otherwise, every time I test it, it works as expected. I don't have VMware Tanzu so can't support you with that.

from registry-creds.

@alexellis i can do, but this also affects my ARM Pi cluster which is straight up vanilla K8S and another x86 vanilla cluster I have too, not just Tanzu.

I never attempted to test it in kind, but I will give that a shot just for comparison's sake.

from registry-creds.

/lock: resolved

from registry-creds.