Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add RBAC permissions for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources. #3190

Merged
merged 1 commit into from
Oct 4, 2024
Merged

Add RBAC permissions for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources. #3190

merged 1 commit into from
Oct 4, 2024

Conversation

mbobrovskyi
Copy link
Contributor

@mbobrovskyi mbobrovskyi commented Oct 4, 2024 •
edited
Loading

What type of PR is this?

/kind bug

What this PR does / why we need it:

Add RBAC permissions for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

To fix an issue:

W1004 06:39:21.286539       1 reflector.go:561] k8s.io/client-go/informers/factory.go:160: failed to list *v1.ValidatingAdmissionPolicyBinding: validatingadmissionpolicybindings.admissionregistration.k8s.io is forbidden: User "system:serviceaccount:kueue-system:kueue-controller-manager" cannot list resource "validatingadmissionpolicybindings" in API group "admissionregistration.k8s.io" at the cluster scope
E1004 06:39:21.286701       1 reflector.go:158] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.ValidatingAdmissionPolicyBinding: failed to list *v1.ValidatingAdmissionPolicyBinding: validatingadmissionpolicybindings.admissionregistration.k8s.io is forbidden: User \"system:serviceaccount:kueue-system:kueue-controller-manager\" cannot list resource \"validatingadmissionpolicybindings\" in API group \"admissionregistration.k8s.io\" at the cluster scope" logger="UnhandledError"
W1004 06:39:26.966153       1 reflector.go:561] k8s.io/client-go/informers/factory.go:160: failed to list *v1.ValidatingAdmissionPolicy: validatingadmissionpolicies.admissionregistration.k8s.io is forbidden: User "system:serviceaccount:kueue-system:kueue-controller-manager" cannot list resource "validatingadmissionpolicies" in API group "admissionregistration.k8s.io" at the cluster scope
E1004 06:39:26.966287       1 reflector.go:158] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.ValidatingAdmissionPolicy: failed to list *v1.ValidatingAdmissionPolicy: validatingadmissionpolicies.admissionregistration.k8s.io is forbidden: User \"system:serviceaccount:kueue-system:kueue-controller-manager\" cannot list resource \"validatingadmissionpolicies\" in API group \"admissionregistration.k8s.io\" at the cluster scope" logger="UnhandledError"

we need to add permissions for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources.

Does this PR introduce a user-facing change?

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/bug Categorizes issue or PR as related to a bug. labels Oct 4, 2024
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 4, 2024
@k8s-ci-robot k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 4, 2024
@netlify Netlify
Copy link

netlify bot commented Oct 4, 2024 •
edited
Loading

✅ Deploy Preview for kubernetes-sigs-kueue ready!

Name Link
🔨 Latest commit b365e10
🔍 Latest deploy log https://app.netlify.com/sites/kubernetes-sigs-kueue/deploys/66ff919e75dc4a0008ddea83
😎 Deploy Preview https://deploy-preview-3190--kubernetes-sigs-kueue.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@mbobrovskyi mbobrovskyi changed the title Add read access for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources. Add RBAC permissions for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources. Oct 4, 2024
@mbobrovskyi
Copy link
Contributor Author

/cc @mimowo

@mimowo
Copy link
Contributor

mimowo commented Oct 4, 2024

Thanks for the PR, are these errors also present on 0.8?

@mbobrovskyi
Copy link
Contributor Author

mbobrovskyi commented Oct 4, 2024 •
edited
Loading

No, IIUC it's happens after update to k8s 1.31.

mimowo
mimowo reviewed Oct 4, 2024
View reviewed changes
Copy link
Contributor

@mimowo mimowo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 4, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mbobrovskyi, mimowo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: cd3ac2c8fe638958f3ebc6e1a813f27ec9543bee

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 4, 2024
@k8s-ci-robot k8s-ci-robot merged commit cf4b5e6 into kubernetes-sigs:main Oct 4, 2024
16 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v0.9 milestone Oct 4, 2024
@mbobrovskyi mbobrovskyi deleted the fix/failed-to-list-v1-validating-admission-policy-binding branch October 4, 2024 09:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mimowo mimowo mimowo left review comments

@alculquicondor alculquicondor Awaiting requested review from alculquicondor

@denkensk denkensk Awaiting requested review from denkensk

Assignees

@mimowo mimowo

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
v0.9
Development

Successfully merging this pull request may close these issues.
3 participants
@mbobrovskyi @mimowo @k8s-ci-robot