search

kubernetes-sigs / cli-utils

This repo contains binaries that built from libraries in cli-runtime.
Apache License 2.0
155 stars 77 forks source link

Feature Request: Apply roles before bindings #638

Open EronWright opened 4 months ago

EronWright commented 4 months ago

Kubernetes imposes a constraint that a role must exist before the binding uses it, when the applier is not a cluster admin. See https://github.com/kubernetes/kubernetes/issues/110989#issuecomment-1281076750. The graph package should create an edge between the role and the binding to facilitate this.

karlkfi commented 1 month ago

You can use the depends-on annotation for this today (https://kpt.dev/reference/annotations/depends-on/). Add the annotation to the binding to depend on the role.

But, yes, it would be nice if it detected this ordering automatically.