lnvps_operator/k8s-minimal.yaml is not what is deployed, so it cannot be applied to a running install without thought.
The manifest puts the ServiceAccount, ClusterRoleBinding subject and Deployment in namespace lnvps-system (k8s-minimal.yaml:8,14,58,86). Production runs as system:serviceaccount:lnvps:lnvps-operator — namespace lnvps — per the 403 in #293. So whatever created the live install was not this file.
Two consequences:
kubectl apply -f lnvps_operator/k8s-minimal.yaml against the live cluster grants the running operator nothing, because it binds a service account in a namespace that does not run it.- If the live ClusterRoleBinding is also named
lnvps-operator, that apply rewrites its subjects and removes the permissions the operator has today.
lnvps_operator/README.md:53 compounds it: it tells you to kubectl apply -f lnvps_operator/k8s-deployment.yaml, and no such file exists in the tree — k8s-minimal.yaml is the only manifest.
I do not know how the live install was created, which is why this is an issue rather than a patch: I cannot tell whether the manifest namespace is wrong or the deployment drifted. Someone with cluster access can settle it with
kubectl get clusterrolebinding lnvps-operator -o yaml
kubectl get sa -n lnvps lnvps-operator -o yaml
Done = the shipped manifest matches the deployed install (or says plainly that it is an example and not the source of truth), and the README points at a file that exists.
Found while reviewing #294 (#293).
lnvps_operator/k8s-minimal.yamlis not what is deployed, so it cannot be applied to a running install without thought.The manifest puts the ServiceAccount, ClusterRoleBinding subject and Deployment in namespace
lnvps-system(k8s-minimal.yaml:8,14,58,86). Production runs assystem:serviceaccount:lnvps:lnvps-operator— namespacelnvps— per the 403 in #293. So whatever created the live install was not this file.Two consequences:
kubectl apply -f lnvps_operator/k8s-minimal.yamlagainst the live cluster grants the running operator nothing, because it binds a service account in a namespace that does not run it.lnvps-operator, that apply rewrites its subjects and removes the permissions the operator has today.lnvps_operator/README.md:53compounds it: it tells you tokubectl apply -f lnvps_operator/k8s-deployment.yaml, and no such file exists in the tree —k8s-minimal.yamlis the only manifest.I do not know how the live install was created, which is why this is an issue rather than a patch: I cannot tell whether the manifest namespace is wrong or the deployment drifted. Someone with cluster access can settle it with
Done = the shipped manifest matches the deployed install (or says plainly that it is an example and not the source of truth), and the README points at a file that exists.
Found while reviewing #294 (#293).