fix: grant RBAC for events.k8s.io Events emitted by the events/v1 recorder#391
fix: grant RBAC for events.k8s.io Events emitted by the events/v1 recorder#391xrl wants to merge 1 commit into
Conversation
…order
The recorder returned by mgr.GetEventRecorder writes events.k8s.io/v1
Events, but role.yaml only granted events verbs in the core ("") API
group, so the API server rejects every operator-emitted Event on real
clusters (envtest does not enforce RBAC):
Server rejected event (will not retry!) ... cannot create resource
"events" in API group "events.k8s.io"
Add an events.k8s.io events create;patch RBAC marker (the two verbs the
client-go tools/events broadcaster uses) and regenerate role.yaml.
Signed-off-by: Xavier Lange <xrlange@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: xrl The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @xrl. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…d Role The overlay role.yaml predates fix etcd-io#391 (events/v1 recorder writes to events.k8s.io, not core/v1); without this rule every operator Event is rejected in the namespace-scoped deployment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Lange <xrlange@gmail.com>
The recorder returned by mgr.GetEventRecorder writes events.k8s.io/v1 Events, but role.yaml only granted events verbs in the core API group, so every TLSReady event (including the new ClientCABroadTrust warning) was silently dropped. Mirrors the standalone fix in etcd-io#391; whichever lands first, the other rebases to a no-op. Signed-off-by: Xavier Lange <xrlange@gmail.com>
1 participant
On a real cluster every operator-emitted Event is rejected by the API server:
Server rejected event (will not retry!) ... User "system:serviceaccount:etcd-operator-system:etcd-operator-controller-manager" cannot create resource "events" in API group "events.k8s.io", sokubectl describe etcdclusteralways showsEvents: <none>. The recorder wired inSetupWithManagerviamgr.GetEventRecorderwritesevents.k8s.io/v1Events, butrole.yamlonly grants events verbs in the core ("") API group — envtest does not enforce RBAC, so tests never catch this. This adds anevents.k8s.ioeventscreate;patchRBAC marker (the two verbs the client-gotools/eventsbroadcaster uses) and regeneratesconfig/rbac/role.yaml. Verified withgo build ./...andgo test ./internal/... ./api/....PR series — operability fixes & TLS
Small single-purpose PRs from live kind-cluster testing of the operator. Each stands alone unless an After is listed. → = this PR.
events.k8s.ioRBAC so operator Events are actually recordedmembers[]/leaderIDfrom one health snapshot (consistent leader)altNames.ipAddressesinto certificatesvalidityDuration(365d,100d12h) as documentedDegradedcondition (was empty status)--max-concurrent-reconciles)podTemplate.specscheduling fields: topologySpread, resources, priorityClass, schedulerNameconfig/surfacespec.tls.{peer,client}surfaces (breaking alpha API)TLSReadycondition + TLS lifecycle EventsPeerCANotSharedEtcdMirrorCRD: one-way cross-cluster replication API (types + CEL)pkg/mirroragentreplication engine (fenced checkpoint-in-target)mirror-agentbinary: config/TLS-reload/statusz/metrics + kind e2e/metricsendpointEtcdBackupCR → object storage (S3/GCS)🟢 ready · ⚪ draft