Skip to content

Conversation

@vdemeester
Copy link
Member

Changes

Better be explicit on the verbs we allow than the wildcard (*). Next
step would be to see if we need all these or not.

Signed-off-by: Vincent Demeester vdemeest@redhat.com

/cc @tektoncd/operator-collaborators @tektoncd/operator-maintainers

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

See the contribution guide for more details.

Release Notes

Replace any wildecard vebr by an explicit list in the roles

@tekton-robot tekton-robot requested review from a team August 17, 2021 13:23
@tekton-robot tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 17, 2021
@nikhil-thomas
Copy link
Member

/approve

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 17, 2021
@vdemeester
Copy link
Member Author

vdemeester commented Aug 17, 2021

default           2m32s       Warning   InternalError             tektonpipeline/pipeline                                              failed to apply (cluster)roles: clusterroles.rbac.authorization.k8s.io "tekton-aggregate-edit" is forbidden: user "system:serviceaccount:tekton-operator:tekton-operator" (groups=["system:serviceaccounts" "system:serviceaccounts:tekton-operator" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:...

hum.. actual legit failure I think 😓 which is super weird.. except if I missed some verb..

@vdemeester
Copy link
Member Author

/retest

@tekton-robot tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 17, 2021
@vdemeester
Copy link
Member Author

/retest

@nikhil-thomas
Copy link
Member

is it because of

kube-system        32m         Warning   FailedCreate                   replicaset/kube-dns-autoscaler-844c9d9448                            Error creating: pods "kube-dns-autoscaler-844c9d9448-" is forbidden: error looking up service account kube-system/kube-dns-autoscaler: serviceaccount "kube-dns-autoscaler" not found

@nikhil-thomas
Copy link
Member

/retest

@vdemeester
Copy link
Member Author

Still a legit failure.. damn…

@vdemeester vdemeester force-pushed the no-wildcard-verbs branch 4 times, most recently from 1553e91 to fa00c6c Compare August 18, 2021 16:53
Better be explicit on the verbs we allow than the wildcard (`*`). Next
step would be to see if we need all these or not.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
@piyush-garg
Copy link
Contributor

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 19, 2021
Copy link
Contributor

@pradeepitm12 pradeepitm12 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@tekton-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nikhil-thomas, pradeepitm12

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot merged commit 32a1955 into tektoncd:main Aug 19, 2021
@nikhil-thomas
Copy link
Member

/lgtm

@vdemeester vdemeester deleted the no-wildcard-verbs branch August 19, 2021 08:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants