Restore pods RBAC needed for NetworkAttachments verification - #740
Conversation
Commit 2adbb94 ("Remove unnecessary pods RBAC permissions") dropped the pods kubebuilder RBAC marker from keystoneapi_controller.go, which calls lib-common's VerifyNetworkStatusFromAnnotation to verify NetworkAttachments. That function lists Pods using the controller-manager's own client, so the manager's ClusterRole (config/rbac/role.yaml) needs get;list on pods or KeystoneAPI gets stuck in NetworkAttachmentsReady=False with a "pods is forbidden" error, as seen on manila/cinder/neutron-operator after the same cleanup. Restore the get;list marker and regenerate config/rbac/role.yaml. The unused rbacRules grant on the workload service account remains removed, since that really is unused. Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abays, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ❌ keystone-openstack-meta-content-provider-master FAILURE in 13m 32s (non-voting) |
|
recheck |
|
/retest |
e841be6
into
openstack-k8s-operators:main
2 participants
Commit 2adbb94 ("Remove unnecessary pods RBAC permissions") dropped the pods kubebuilder RBAC marker from keystoneapi_controller.go, which calls lib-common's VerifyNetworkStatusFromAnnotation to verify NetworkAttachments. That function lists Pods using the controller-manager's own client, so the manager's ClusterRole (config/rbac/role.yaml) needs get;list on pods or KeystoneAPI gets stuck in NetworkAttachmentsReady=False with a "pods is forbidden" error, as seen on manila/cinder/neutron-operator after the same cleanup. Restore the get;list marker and regenerate config/rbac/role.yaml. The unused rbacRules grant on the workload service account remains removed, since that really is unused.