search

habitat-sh / habitat-operator

A Kubernetes operator for Habitat services
Apache License 2.0
61 stars 17 forks source link

[RBAC] Remove permission for Deployments #339

Closed surajssd closed 6 years ago

surajssd commented 6 years ago

Habitat spec v1beta1 needed to do CRUD on Deployments so it had permissions on the Kubernetes Deployments resource.

Now that it's support is removed no more operations of Deployments are done. Hence this commit removes the permission to Deployments.

irvingpop commented 6 years ago

@surajssd @krnowak FWIW, this change bit me today - because the habitat-operator container definition is still 0.7.2, but the example configs changed. I fixed it by checking out the 0.7.2 tag from git and then reapplying.

for future travelers, this error loops forever:

E0910 19:29:59.107469       1 reflector.go:205] github.com/habitat-sh/habitat-operator/pkg/controller/v1beta1/controller.go:127: Failed to list *v1beta1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:default:habitat-operator" cannot list deployments.apps at the cluster scope: Unknown user "system:serviceaccount:default:habitat-operator"
E0910 19:30:00.109488       1 reflector.go:205] github.com/habitat-sh/habitat-operator/pkg/controller/v1beta1/controller.go:127: Failed to list *v1beta1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:default:habitat-operator" cannot list deployments.apps at the cluster scope: Unknown user "system:serviceaccount:default:habitat-operator"
surajssd commented 6 years ago

@irvingpop we are making a new release and this should be fixed, because you will be able to pull the latest image, tracked in https://github.com/habitat-sh/habitat-operator/issues/355

krnowak commented 5 years ago

That's #228 and #231.