search

indeedeng / harbor-container-webhook

mutating webhook which rewrites container images to use a Harbor proxy cache
Apache License 2.0
68 stars 15 forks source link

Cluster scope access needed for secrets when checkUpstream is true #33

Open john-jam opened 6 months ago

john-jam commented 6 months ago

When using a private registry with credentials available in authSecretName and when defining checkUpstream: true, the webhook fails to read the secret and indicates that a permission to read them at the cluster scope is missing:

2024-02-22T06:59:04Z    INFO    controller-runtime.webhook  Serving webhook server  {"host": "", "port": 9443}
2024-02-22T06:59:04Z    INFO    controller-runtime.certwatcher  Starting certificate watcher
2024-02-22T06:59:51Z    INFO    mutator token key:  {"key": {"name":"docker-cfg","namespace":"harbor-container-webhook"}}
W0222 06:59:51.704213       1 reflector.go:535] pkg/mod/k8s.io/client-go@v0.28.4/tools/cache/reflector.go:229: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:harbor-container-webhook:harbor-container-webhook" cannot list resource "secrets" in API group "" at the cluster scope

If we disable checkUpstream, the connection with the private registry works fine.

Should the right ClusterRole be added to the service account created by the helm chart or should the webhook code be updated to have it work with namespaced Roles? Happy to create a PR.

mpsOxygen commented 5 months ago

I'm hitting the same problem. Did you find way aroung it?