estafette / estafette-gke-preemptible-killer

Kubernetes controller to spread preemption for preemtible VMs in GKE to avoid mass deletion after 24 hours

Home Page:https://helm.estafette.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Incomplete Documentation

EntrepreneurAJ opened this issue · comments

After the changes to the newer Helm repo, when I install fresh it always gives a 403 error when following the readme file.

Pre private helm repo there used to be a flag to show where the Google Service Account JSON Key was this seems to be no more as a result HTTP 403 Forbidden is being received from the Kubernetes API.

Same. It appears that the cluster role is missing permissions to access nodes

For now, I create a custom additional cluster role and binding in my own chart. I'll open a PR to add this to the role in this repo:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "core.fullname" . }}
  labels:
      app.kubernetes.io/name: {{ include "core.name" . }}
      helm.sh/chart: {{ include "core.chart" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
rules:
  - apiGroups: [""] # "" indicates the core API group
    resources:
      - nodes
    verbs:
      - get
      - list
      - update
  - apiGroups: [""] # "" indicates the core API group
    resources:
      - pods
    verbs:
      - get
      - list
      - delete

The ClusterRole will be fixed in milestone 1.2.3 via #57