search

buildkite / agent-stack-k8s

Spin up an autoscaling stack of Buildkite Agents on Kubernetes
MIT License
79 stars 30 forks source link

Fix custom namespace deploy Role errors in RBAC #329

Closed artem-zinnatullin closed 4 months ago

artem-zinnatullin commented 4 months ago

Deploying v0.11.0 to custom namespace results in an error:

W0516 23:52:47.169746       1 reflector.go:539] k8s.io/client-go@v0.29.3/tools/cache/reflector.go:229: 
failed to list *v1.Job: jobs.batch is forbidden: User "system:serviceaccount:my-namespace:my-deploy-name-v1-controller" cannot list resource "jobs" in API group "batch" in the namespace "my-namespace"

The Role in RBAC should be bound to a namespace, however declaring namespace via serviceAccountMetadata (which gets injected into the Role) is specifically not allowed.

To be honest I'm baffled at how is deploy was supposed to work for users with custom namespace, does everyone deploy to a default namespace or am I missing something? 🤔

artem-zinnatullin commented 4 months ago

Hm, there must have been some error in my setup, I'm now getting namespace added into the Role without this PR.

Apologies for the noise!

artem-zinnatullin commented 4 months ago

Okay, I double-checked and it's the RoleBinding that needs to be fixed, not the Role -> #330