fix(rbac): add bind/escalate verbs for k8s install#3739
Conversation
tekton-robot
added
the
release-note
tekton-robot
added
the
size/L
The Kubernetes install manifests (Helm chart and kustomize base) lacked the bind/escalate verbs on clusterroles/roles that the OpenShift manifests already had. Without them, Kubernetes RBAC's self-escalation check blocks the operator from creating Pipelines-as-Code's aggregate ClusterRole, so its ServiceAccounts and Deployments are never created. Align the Kubernetes RBAC with the OpenShift RBAC by granting bind/escalate on clusterroles/roles. Verified by reproducing the failure with the v0.80.0 Helm chart on a kind cluster and confirming Pipelines-as-Code installs successfully once the verbs are added. Fixes tektoncd#3682 Signed-off-by: Jawed khelil <jkhelil@redhat.com> Assisted-by: Claude Sonnet 5 (via Cursor) Co-authored-by: Cursor <cursoragent@cursor.com>
87a1fb8 to
6e46e82
Compare
tekton-robot
added
size/XS
|
/lgtm |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3739 +/- ##
=======================================
Coverage 25.55% 25.55%
=======================================
Files 448 448
Lines 23317 23317
=======================================
Hits 5958 5958
Misses 16674 16674
Partials 685 685
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
/kind bug |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: anithapriyanatarajan The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
|
/cherry-pick release-0.80.x |
|
❌ Cherry-pick to The automatic cherry-pick to Output: Next steps:
|
|
/cherry-pick release-v0.80.x |
1 similar comment
|
/cherry-pick release-v0.80.x |
|
✅ Cherry-pick to A new pull request has been created to cherry-pick this change to PR: #3750 Please review and merge the cherry-pick PR. |
5 participants
Changes
The Kubernetes install manifests (Helm chart
charts/tekton-operator/templates/kubernetes-rbac.yamland kustomize base
config/base/role.yaml) were missing thebind/escalateverbs on
clusterroles/rolesthat the OpenShift manifests(
openshift-rbac.yaml/config/openshift/base/role.yaml) already have.Without these verbs, Kubernetes RBAC's self-escalation protection blocks the
tekton-operatorServiceAccount from creating thepipelines-as-code-aggregateClusterRole (since it grants permissions, e.g. on
pipelinesascode.tekton.dev/repositories,that the operator's own ClusterRole doesn't directly hold). This causes the
static InstallerSet for Pipelines-as-Code to fail, so its ServiceAccounts and
Deployments are never created and PAC pods stay pending.
This aligns the Kubernetes RBAC with the OpenShift RBAC by granting
bind/escalateonclusterroles/roles, the same pattern used to fix asimilar RBAC gap in #3519.
Verification
Reproduced the reported failure by installing the
v0.80.0Helm chart on akind cluster and enabling Pipelines-as-Code via
TektonConfig:After granting
bind/escalateon the operator's ClusterRole, the sameInstallerSet applied successfully and all Pipelines-as-Code deployments came
up:
Fixes #3682
Submitter Checklist
make test lintbefore submitting a PRRelease Notes
Made with Cursor