water-hole / ansible-operator

POC Code for the operator backed by ansible
48 stars 29 forks source link

Proxy code leads to resources being created by `system:anonymous` leads to 403 #5

Closed ehelms closed 6 years ago

ehelms commented 6 years ago

I mentioned this to @fabianvf but figure its always good to track issues. New proxy code leads to resources being created by system:anonymous instead of the service account associated with the deployment:

TASK [service-accounts : foreman-anyuid service account] ***********************
task path: /opt/ansible/roles/service-accounts/tasks/main.yml:2
fatal: [localhost]: FAILED! => {"changed": false, "error": 403, "msg": "Failed to retrieve requested object: {\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\",\"message\":\"serviceaccounts \\\"foreman-anyuid\\\" is forbidden: User \\\"system:anonymous\\\" cannot get serviceaccounts in the namespace \\\"foreman\\\": User \\\"system:anonymous\\\" cannot get serviceaccounts in project \\\"foreman\\\"\",\"reason\":\"Forbidden\",\"details\":{\"name\":\"foreman-anyuid\",\"kind\":\"serviceaccounts\"},\"code\":403}\n", "reason": "Forbidden", "status": 403}
shawn-hurley commented 6 years ago

@ehelms Wondering if the master branch will work now that we have merged in the runner stuff?

ehelms commented 6 years ago

I had tested your fix for this individually on top of master prior to the runner work being merged so I'll close this issue. Thanks!