search

kubecfg / kubit

install kubecfg packages in-cluster
Apache License 2.0
6 stars 3 forks source link

fix: kubit-applier SA needs CRD delete permission #476

Closed waynr closed 2 months ago

waynr commented 2 months ago

In order to delete CRDs that it creates (ie when doing cleanup finalization for an AppInstance), kubit-applier needs delete permission.

kubit-cleanup-influxdb-c8g6l cleanup-manifests error: pruning CustomResourceDefinition.apiextensions.k8s.io licenses.influxdata.io: customresourcedefinitions.apiextensions.k8s.io "licenses.influxdata.io" is forbidden: User "system:serviceaccount:influxdb:kubit-applier" cannot delete resource "customresourcedefinitions" in API group "apiextensions.k8s.io" at the cluster scope

This PR adds the necessary delete permission to the existing ClusterRole. It also renames some functions and moves their calling location as a bit of added cleanup.