Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changing permissions of UCP - removing unused permissions #8080

Merged
merged 2 commits into from
Dec 13, 2024
Merged

Changing permissions of UCP - removing unused permissions #8080

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ce6e25
Changing permissions of UCP - removing unused permissions
ytimocin Nov 24, 2024
1accbb7
Commenting this test out to see if the rest of tests will pass
ytimocin Nov 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 35 additions & 49 deletions deploy/Chart/templates/ucp/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,52 +6,38 @@ metadata:
app.kubernetes.io/name: ucp
app.kubernetes.io/part-of: radius
rules:
- apiGroups:
- ""
resources:
- configmaps
- secrets
- services
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- apps
resources:
- deployments
- statefulsets
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ucp.dev
resources:
- resources
- queuemessages
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- api.ucp.dev
resources:
- '*'
verbs:
- '*'
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- delete
- get
- update

- apiGroups:
- ucp.dev
resources:
- resources
- queuemessages
verbs:
- create
- delete
- get
- list
- update

- apiGroups:
- api.ucp.dev
resources:
- "*"
verbs:
- create
- delete
- get
- list
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing this causes this error (an error that we have all seen before but didn't know why):

Radius release not found. Proceeding with installation.
*** Installing Radius to Kubernetes ***
Installing Radius version 8d1442d-dirty to namespace: radius-system...
*** Create workspace, group and environment for test ***
Creating workspace...
Set "kind-kind" as current workspace
Error: An unknown error was returned while testing Radius API status:
Status Code: 503
Response Headers:
  Audit-Id: 863b6ad6-02a3-4ba6-9c51-61f03dc66cf2
  Cache-Control: no-cache, private
  Content-Length: 20
  Content-Type: text/plain; charset=utf-8
  Date: Sun, 24 Nov 2024 16:36:20 GMT
  X-Content-Type-Options: nosniff
  X-Kubernetes-Pf-Flowschema-Uid: db65b004-bc64-4949-a3b2-2a0[80](https://github.com/radius-project/radius/actions/runs/11997783030/job/33443799631?pr=8080#step:18:81)1c4da00
  X-Kubernetes-Pf-Prioritylevel-Uid: fe22ed3a-e9f4-4f37-9901-d2347e099c15
Response Body:
service unavailable

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logs will have the real error.

Copy link
Contributor

@kachawla kachawla Dec 13, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ytimocin did you get a chance to look into the logs for error as Ryan recommended?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, I missed that window. It is a resource permission issue but not exactly sure which one. I will keep an eye out for this error.

Expand All @@ -65,6 +51,6 @@ roleRef:
kind: ClusterRole
name: ucp
subjects:
- kind: ServiceAccount
name: ucp
namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
name: ucp
namespace: {{ .Release.Namespace }}
Loading