ManageIQ / manageiq-pods

ManageIQ on Kubernetes and OpenShift
Apache License 2.0
51 stars 100 forks source link

Give the operator permission to give permission to pod/logs get #1000

Closed bdunne closed 11 months ago

bdunne commented 11 months ago

Followup to #999

Fixes:

2023-10-10T16:16:02Z    ERROR   Reconciler error    {"controller": "manageiq", "controllerGroup": "manageiq.org", "controllerKind": "ManageIQ", "ManageIQ": {"name":"manageiq-sample","namespace":"miq"}, "namespace": "miq", "name": "manageiq-sample", "reconcileID": "8c9e0471-2231-4d18-ac75-7ef1530ccaed", "error": "roles.rbac.authorization.k8s.io \"manageiq-automation\" is forbidden: user \"system:serviceaccount:miq:manageiq-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:miq\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"pods/logs\"], Verbs:[\"get\"]}"} sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.2/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.2/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.2/pkg/internal/controller/controller.go:227
miq-bot commented 11 months ago

Checked commit https://github.com/bdunne/manageiq-pods/commit/4a7896cfb42ff1302091097595c024c682099372 with ruby 2.6.10, rubocop 1.28.2, haml-lint 0.35.0, and yamllint 1 file checked, 1 offense detected

**

Fryguy commented 11 months ago

Backported to quinteros in commit 4d46872acc845ce6a6d3d6fe9fa751bf6be5ac48.

commit 4d46872acc845ce6a6d3d6fe9fa751bf6be5ac48
Author: Jason Frey <fryguy9@gmail.com>
Date:   Tue Oct 10 13:12:57 2023 -0400

    Merge pull request #1000 from bdunne/automation_role_pods_logs

    Give the operator permission to give permission to pod/logs get

    (cherry picked from commit a281143223f073f851c63de9aa11008f9d88c431)