Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[server] Add kube-rbac-proxy rolebinding to SA #4745

Merged
merged 1 commit into from
Jul 8, 2021

Conversation

csweichel
Copy link
Contributor

@csweichel csweichel commented Jul 8, 2021

Server metrics scraping is broken because of a missing role binding:

"Failed to make webhook authenticator request: tokenreviews.authentication.k8s.io is forbidden: User "system:serviceaccount:default:server" cannot create resource "tokenreviews" in API group "authentication.k8s.io" at the cluster scope" 

fixes #4739

/werft no-preview

@csweichel csweichel requested a review from meysholdt July 8, 2021 10:11
@csweichel csweichel requested a review from a team as a code owner July 8, 2021 10:11
@csweichel csweichel requested review from corneliusludmann and removed request for a team July 8, 2021 10:11
@meysholdt meysholdt requested a review from ArthurSens July 8, 2021 10:18
Copy link
Contributor

@ArthurSens ArthurSens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this supposed to fix agent-smith or server?

If it is agent-smith then you changed the wrong file 😬

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Release.Namespace }}-agent-smith-rb-kube-rbac-proxy
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
name: {{ .Release.Namespace }}-agent-smith-rb-kube-rbac-proxy
name: {{ .Release.Namespace }}-server-rb-kube-rbac-proxy

name: {{ .Release.Namespace }}-agent-smith-rb-kube-rbac-proxy
labels:
app: {{ template "gitpod.fullname" . }}
component: agent-smith
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
component: agent-smith
component: server

stage: {{ .Values.installation.stage }}
subjects:
- kind: ServiceAccount
name: agent-smith
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
name: agent-smith
name: server

@csweichel
Copy link
Contributor Author

Good catch - I was a bit too quick here. Will fix

@csweichel csweichel force-pushed the csweichel/server-metrics-are-broken-4739 branch from 98b0bd6 to 9338461 Compare July 8, 2021 10:51
@csweichel csweichel requested a review from ArthurSens July 8, 2021 10:51
@csweichel csweichel merged commit ea54a59 into main Jul 8, 2021
@csweichel csweichel deleted the csweichel/server-metrics-are-broken-4739 branch July 8, 2021 10:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[server] Metrics are broken since the introduction of kube-rbac-proxy
2 participants