Skip to content
This repository has been archived by the owner on Jun 20, 2023. It is now read-only.

Allow the cilium-olm role to manage ingresses resources #78

Open
kazuhisya opened this issue Aug 6, 2022 · 0 comments · May be fixed by #80
Open

Allow the cilium-olm role to manage ingresses resources #78

kazuhisya opened this issue Aug 6, 2022 · 0 comments · May be fixed by #80

Comments

@kazuhisya
Copy link

kazuhisya commented Aug 6, 2022

Hello Team,

Env: OCP / cilium-olm v1.12.0

When hubble is enabled via the CiliumConfig, the hubble-ui pod starts failing at OCP env.

  hubble:
    enabled: true
    metrics:
      enabled:
      - dns:query;ignoreAAAA
      - drop
      - tcp
      - flow
      - icmp
      - http
      serviceMonitor:
        enabled: true
    tls:
      enabled: true
    relay:
      enabled: true
    ui:
      enabled: true
      ingress:
        enabled: true
        hosts:
          - hubble-ui-cilium.apps.xxx.xxx.xxx

There is not enough permit for "ingresses".
Adding a role can solve this, but it's useful if it's enabled from the beginning.

$ oc edit role -n cilium cilium-olm -o yaml
# add following lines
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - '*'

Additional Information:
Maybe this can be solved by adding lines like this near line 346 in rbac.cue, but I'm not familiar with cue....

	{
		apiGroups: [
			"networking.k8s.io",
		]
		resources: [
			"ingresses",
		]
		verbs: [
			"*",
		]
	},

https://github.com/cilium/cilium-olm/blob/master/config/operator/rbac.cue#L346

Thank you,

tongpu added a commit to tongpu/cilium-olm that referenced this issue Sep 6, 2022
@tongpu tongpu linked a pull request Sep 6, 2022 that will close this issue
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant