should we grant role related permissinos to listener?

[dongho-jung]

2023-11-13T10:34:06Z ERROR Reconciler error {"controller": "autoscalingrunnerset", "controllerGroup": "actions.github.com", "controllerKind": "AutoscalingRunnerSet", "AutoscalingRunnerSet": {"name":"devops-arc","namespace":"arc"}, "namespace": "arc", "name": "devops-arc", "reconcileID": "3ce356bd-74df-48e3-b959-9890ccff544e", "error": "failed to patch manager role binding without finalizer: rolebindings.rbac.authorization.k8s.io "devops-arc-gha-rs-controller-manager" is forbidden: User "system:serviceaccount:arc:arc" cannot patch resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "arc""}sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:329sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2 sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:2352023-11-13T10:34:06Z INFO AutoscalingListener Creating a role for the listener pod {"autoscalinglistener": "arc/amd64-fd47b7ff-listener"}2023-11-13T10:34:06Z INFO AutoscalingListener Creating listener role {"autoscalinglistener": "arc/amd64-fd47b7ff-listener", "namespace": "arc", "name": "amd64-fd47b7ff-listener", "rules": [{"verbs":["patch"],"apiGroups":["actions.github.com"],"resources":["ephemeralrunnersets"],"resourceNames":["amd64-lm9cw"]},{"verbs":["patch"],"apiGroups":["actions.github.com"],"resources":["ephemeralrunners","ephemeralrunners/status"]}]}2023-11-13T10:34:06Z ERROR AutoscalingListener Unable to create listener role {"autoscalinglistener": "arc/amd64-fd47b7ff-listener", "namespace": "arc", "name": "amd64-fd47b7ff-listener", "rules": [{"verbs":["patch"],"apiGroups":["actions.github.com"],"resources":["ephemeralrunnersets"],"resourceNames":["amd64-lm9cw"]},{"verbs":["patch"],"apiGroups":["actions.github.com"],"resources":["ephemeralrunners","ephemeralrunners/status"]}], "error": "roles.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:arc:arc" cannot create resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "arc""}github.com/actions/actions-runner-controller/controllers/actions%2egithub%2ecom.(*AutoscalingListenerReconciler).createRoleForListener github.com/actions/actions-runner-controller/controllers/actions.github.com/autoscalinglistener_controller.go:545github.com/actions/actions-runner-controller/controllers/actions%2egithub%2ecom.(*AutoscalingListenerReconciler).Reconcile github.com/actions/actions-runner-controller/controllers/actions.github.com/autoscalinglistener_controller.go:187sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:122sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:323sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2 sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:2352023-11-13T10:34:06Z ERROR Reconciler error {"controller": "autoscalinglistener", "controllerGroup": "actions.github.com", "controllerKind": "AutoscalingListener", "AutoscalingListener": {"name":"amd64-fd47b7ff-listener","namespace":"arc"}, "namespace": "arc", "name": "amd64-fd47b7ff-listener", "reconcileID": "6ab19d04-0d18-4751-8582-eb526bfc4b0f", "error": "roles.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:arc:arc" cannot create resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "arc""}sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:329sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2 sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:235

I encountered an issue while setting up a new ARC system. To resolve it, I modified the permissions as suggested by the error message. After making these changes, the issue was resolved. Was this due to a configuration error on my part, or is this a required step in the setup process?

[krumware]

This is also an issue we observed and have not determined how to solve