panic when secretReader is disabled

[zswanson]

Hi we're using AWS ECR and not using image pull secrets, just IAM restrictions with IRSA. We have chart 1.0.1 with appVersion 1.1.0 installed and it is frequently dumping panics in the following form. Because we have the secretReader option disabled, its not creating a ClusterRole or ClusterRoleBinding so its not surprising it gets permission denied. It is however surprising that it is trying to access the 'default' serviceAccount in a different namespace when its not configured to do so.

7:35PM ERR error fetching referenced service account, continue without service account imagePullSecrets error="serviceaccounts "default" is forbidden: User "system:serviceaccount:image-swapper:image-swapper" cannot get resource "serviceaccounts" in API group "" in the namespace "myappnamespace""
Worker exits from a panic: runtime error: invalid memory address or nil pointer dereference
Stack trace: goroutine 198 [running]:
runtime/debug.Stack()
runtime/debug/stack.go:24 +0x65
github.com/alitto/pond.defaultPanicHandler({0x1946000, 0x2c8fa20})
github.com/alitto/[email protected]/pond.go:19 +0x27
github.com/alitto/pond.(*WorkerPool).executeTask.func1()
github.com/alitto/[email protected]/pond.go:364 +0x45
panic({0x1946000, 0x2c8fa20})
runtime/panic.go:1038 +0x215
os.(*File).Name(...)
os/file.go:57
github.com/estahn/k8s-image-swapper/pkg/webhook.(*ImageSwapper).Mutate.func1()
github.com/estahn/[email protected]/pkg/webhook/image_swapper.go:219 +0x317
github.com/alitto/pond.(*WorkerPool).executeTask(0xc00073d3b0, 0x1ebce10)
github.com/alitto/[email protected]/pond.go:371 +0x69
github.com/alitto/pond.worker(0xc000199200, 0x1ea74e8, 0xc00073d3ec, 0x0, 0xc0007e7d80)
github.com/alitto/[email protected]/pond.go:427 +0x79
created by github.com/alitto/pond.(*WorkerPool).maybeStartWorker

[estahn]

@zswanson Thanks for the detailed error description. Will have a look soon.

[zswanson]

Actually we just set secretReader.enabled: true in the values and redeployed (left the secretReader.secretNames: [] as empty) and its still producing this error.