tk apply crashes by creating Role from helm chart

[mqueack]

Using helm chart 0.33.1 from timescaledb-single https://github.com/timescale/helm-charts/tree/main/charts/timescaledb-single
crashes with

$ tk apply environments/dev-new/
Error: got an error while extracting env `environments/dev-new`: found invalid Kubernetes object (at .hex_deploy.hex_deploy.timescaledb.role_hex_timescaledb.rules.[0].apiGroups): missing attribute "apiVersion"

apiGroups:
    - ""
resources:
    - services
verbs:
    - create
    - get
    - list
    - update
    - patch
    - delete
    - watch

Using helm template prints an valid yaml file.
an older version of this template 0.27.0 is working without a problem

output of 0.27.0 with tk eval

$ tk eval environments/dev/ | jq .hex_deploy.hex_deploy.timescaledb.role_hex_timescaledb
{
  "apiVersion": "rbac.authorization.k8s.io/v1",
  "kind": "Role",
  "metadata": {
    "labels": {
      "app": "hex-timescaledb",
      "app.kubernetes.io/component": "rbac",
      "app.kubernetes.io/managed-by": "Helmraiser",
      "app.kubernetes.io/name": "hex-timescaledb",
      "app.kubernetes.io/version": "0.27.0",
      "chart": "timescaledb-single-0.27.0",
      "cluster-name": "hex-timescaledb",
      "heritage": "Helm",
      "release": "hex"
    },
    "name": "hex-timescaledb",
    "namespace": "dev"
  },
  "rules": [
    {
      "apiGroups": [
        ""
      ],
      "resources": [
        "configmaps"
      ],
      "verbs": [
        "create",
        "get",
        "list",
        "patch",
        "update",
        "watch",
        "delete"
      ]
    },
    {
      "apiGroups": [
        ""
      ],
      "resources": [
        "endpoints",
        "endpoints/restricted"
      ],
      "verbs": [
        "create",
        "get",
        "patch",
        "update",
        "list",
        "watch",
        "delete"
      ]
    },
    {
      "apiGroups": [
        ""
      ],
      "resources": [
        "pods"
      ],
      "verbs": [
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "apiGroups": [
        ""
      ],
      "resources": [
        "services"
      ],
      "verbs": [
        "create",
        "get",
        "list",
        "update",
        "patch",
        "delete",
        "watch"
      ]
    }
  ]
}

output of 0.33.1

tk eval environments/dev/ | jq .hex_deploy.hex_deploy.timescaledb.role_hex_timescaledb
{
  "rules": [
    {
      "apiGroups": [
        ""
      ],
      "resources": [
        "services"
      ],
      "verbs": [
        "create",
        "get",
        "list",
        "update",
        "patch",
        "delete",
        "watch"
      ]
    }
  ]
}

used tk version v0.26.0
Is this a bug in tanka, creating/converting to jsonnet roles?

[Duologic]

Can you show the Jsonnet code for this?

[Duologic]

Could it be that you override the role rules in jsonnet but that the Role name changed? This commit gives me an indication that it changed: timescale/helm-charts@d26fefe

[mqueack]

@Duologic thanks for your hint.
That was the problem.

I added a role rule patch at the end of my libsonnet file and the change in timescale helm broke my deployment.