search

upbound / universal-crossplane

Enterprise-grade @crossplane from @upbound
https://upbound.io/product/universal-crossplane
Apache License 2.0
117 stars 31 forks source link

Latest UXP version broke RBAC in provider e2e tests #442

Open mbbush opened 4 months ago

mbbush commented 4 months ago

What happened?

I noticed that all the e2e tests in provider-aws were failing, even ones that had previously been passing on the exact same commit.

I traced the issue down to the common build module passing an empty UXP_VERSION parameter to up uxp install, which then installs the latest version, which was released yesterday.

This shows up in the provider logs, and doesn't go away, even if the provider runs for tens of minutes:

E0301 22:54:16.207615       1 reflector.go:147] k8s.io/client-go@v0.29.2/tools/cache/reflector.go:229: Failed to watch *v1beta1.ProviderConfig: failed to list *v1beta1.ProviderConfig: providerconfigs.aws.upbound.io is forbidden: User "system:serviceaccount:upbound-system:provider-aws-iam-provider-aws" cannot list resource "providerconfigs" in API group "aws.upbound.io" at the cluster scope

How can we reproduce it?

Run any of the e2e tests in upbound provider-aws.

To revert, add export UXP_VERSION := 1.14.6-up.1 to the Makefile, delete your kind cluster, and start over, and now the tests pass.

What environment did it happen in?

UXP version: 1.15.0-up.1

I haven't tried installing UXP 1.15 on any real clusters yet, so I don't know if the issue is a test-only problem, or the test config needs to be updated, or if it's a real bug in UXP. I also haven't tried running the tests with upstream crossplane.

mbbush commented 4 months ago

My best guess as to what is going on is that something about the way the e2e tests copy the providers into the crossplane pod is causing the RBAC manager to decide that they're not part of the same family.