search

datawire / ambassador-chart

Helm Chart for Installing Ambassador
42 stars 60 forks source link

Grant delete CRD permission for ambassador service account #152

Closed MateuszCzubak closed 3 years ago

MateuszCzubak commented 3 years ago

When .Values.crds.keep is set to false, ambassador service account will attempt to remove all CRDs it has created. In order to succeed it must have the delete permission granted for the customresourcedefinitions resource, otherwise an attempt to delete CRDs leads to an error:

Error from server (Forbidden): customresourcedefinitions.apiextensions.k8s.io "projects.getambassador.io" is forbidden: User "system:serviceaccount:ambassador:ambassador" cannot delete resource "customresourcedefinitions" in API group "apiextensions.k8s.io" at the cluster scope
MateuszCzubak commented 3 years ago

This should resolve https://github.com/datawire/ambassador-chart/issues/149