litmuschaos / litmus-helm

Helm Charts for the Litmus Chaos Operator & CRDs
Apache License 2.0
46 stars 88 forks source link

Missing "patch" permission to subscriber serviceAccount rules on "litmuschaos.io" and "argoproj.io" apiGroups #387

Closed vitor-campos closed 4 months ago

vitor-campos commented 4 months ago

The "patch" permission for subscriber serviceAccount is required for stopping an experiment run and this permission is missing in the chart. It causes a permission error in the subscriber when the user ask to stop, keeping the experiment running with no feedback to the user.

time="2024-07-05T15:32:52Z" level=info msg="failed to stop chaosEngine for : test-nl-wg-orch-api-1720193366984 namespace: litmus : failed to patch chaosengines: chaosengines.litmuschaos.io \"pod-network-latency-aqotk6mf\" is forbidden: User  │
 \"system:serviceaccount:litmus:litmus-agent-subscriber\" cannot patch resource \"chaosengines\" in API group \"litmuschaos.io\" in the namespace \"litmus\""                                                                                      
 time="2024-07-05T15:32:52Z" level=info msg="failed to stop experiment: test-nl-wg-orch-api-1720193366984 namespace: litmus : error in patching workflow: workflows.argoproj.io \"test-nl-wg-orch-api-1720193366984\" is forbidden: User \"system: │
 serviceaccount:litmus:litmus-agent-subscriber\" cannot patch resource \"workflows\" in API group \"argoproj.io\" in the namespace \"litmus\""