Repository navigation
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: xrl The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @xrl. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…d Role The overlay role.yaml predates fix etcd-io#391 (events/v1 recorder writes to events.k8s.io, not core/v1); without this rule every operator Event is rejected in the namespace-scoped deployment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Lange <xrlange@gmail.com>
The recorder returned by mgr.GetEventRecorder writes events.k8s.io/v1 Events, but role.yaml only granted events verbs in the core API group, so every TLSReady event (including the new ClientCABroadTrust warning) was silently dropped. Mirrors the standalone fix in etcd-io#391; whichever lands first, the other rebases to a no-op. Signed-off-by: Xavier Lange <xrlange@gmail.com>
…order
The recorder returned by mgr.GetEventRecorder writes events.k8s.io/v1
Events, but role.yaml only granted events verbs in the core ("") API
group, so the API server rejects every operator-emitted Event on real
clusters (envtest does not enforce RBAC):
Server rejected event (will not retry!) ... cannot create resource
"events" in API group "events.k8s.io"
Add an events.k8s.io events create;patch RBAC marker (the two verbs the
client-go tools/events broadcaster uses) and regenerate role.yaml.
Signed-off-by: Xavier Lange <xrlange@gmail.com>
aae6fe2 to
13249ca
Compare
SetupWithManagerwiresr.Recorder = mgr.GetEventRecorder(...), anevents.k8s.io/v1recorder, butrole.yamlonly grantseventsverbs in the core ("") group. The first Event the operator emits will be rejected by the API server (cannot create resource "events" in API group "events.k8s.io"), andkubectl describe etcdclustershowsEvents: <none>. envtest doesn't enforce RBAC, so tests don't catch it.On main the recorder isn't called yet, so this is latent; it bites as soon as the workflows start emitting Events (recreate/replace/NOSPACE are natural places). This adds an
events.k8s.iocreate;patchRBAC marker (the verbs thetools/eventsbroadcaster uses) and regeneratesconfig/rbac/role.yaml.Rebased onto main after the #362 rewrite.
make testandmake lintpass;make manifestsshows no drift.