Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[kustomize] update operator manager rbac #1217

Merged
merged 1 commit into from
Jun 4, 2024
Merged

Conversation

celenechang
Copy link
Contributor

What does this PR do?

Update cluster role for #1146

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

  • Agent: vX.Y.Z
  • Cluster Agent: vX.Y.Z

Describe your test plan

Deploy the operator with make deploy.

Enable admissionController.cwsInstrumentation and make sure there are no RBAC errors like the following:

{"level":"ERROR","ts":"2024-06-04T18:17:32Z","msg":"Reconciler error","controller":"datadogagent","controllerGroup":"datadoghq.com","controllerKind":"DatadogAgent","datadogAgent":{"name":"datadog","namespace":"system"},"namespace":"system","name":"datadog","reconcileID":"acfb8cb6-e425-4e62-954b-4b2e3e051a63","error":"clusterroles.rbac.authorization.k8s.io \"datadog-cluster-agent\" is forbidden: user \"system:serviceaccount:system:datadog-operator-controller-manager\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:system\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"pods/exec\"], Verbs:[\"create\"]}","errorCauses":[{"error":"clusterroles.rbac.authorization.k8s.io \"datadog-cluster-agent\" is forbidden: user \"system:serviceaccount:system:datadog-operator-controller-manager\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:system\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"pods/exec\"], Verbs:[\"create\"]}"}]}
  features:
    admissionController:
      enabled: true
      cwsInstrumentation:
        enabled: true
        mode: "remote_copy"

Checklist

  • PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
  • PR has a milestone or the qa/skip-qa label

@celenechang celenechang added bug Something isn't working tooling labels Jun 4, 2024
@celenechang celenechang added this to the v1.7.0 milestone Jun 4, 2024
@celenechang celenechang requested review from a team as code owners June 4, 2024 18:39
@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.32%. Comparing base (f424448) to head (81d8670).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #1217   +/-   ##
=======================================
  Coverage   59.32%   59.32%           
=======================================
  Files         177      177           
  Lines       22244    22244           
=======================================
  Hits        13196    13196           
  Misses       8236     8236           
  Partials      812      812           
Flag Coverage Δ
unittests 59.32% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f424448...81d8670. Read the comment docs.

@celenechang celenechang merged commit ed39727 into main Jun 4, 2024
23 checks passed
@celenechang celenechang deleted the celene/pods_exec_rbac branch June 4, 2024 18:55
celenechang added a commit that referenced this pull request Jun 4, 2024
celenechang added a commit that referenced this pull request Jun 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working tooling
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants