rock
3630721366
key-rotation-controller / image (push) Failing after 5s
Three faults stopped the controller from running, each found by running it:
image arch the first build was arm64 and every node is amd64, so the pod died
with 'exec format error'. imagePullPolicy IfNotPresent kept the
cached wrong-arch layer, so it is now Always.
leases leader election needs coordination.k8s.io/leases. Without it the
controller never acquired its lock and never reconciled.
secrets list the manager caches Secrets, so it needs list and watch, not only
get, create, update and patch.
go.mod and go.sum gained the procfs entry the build needs.
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: key-rotation-controller
|
|
namespace: iam
|
|
---
|
|
# Cluster-wide because a credential and its consumer live in different namespaces:
|
|
# the Secret in one, the workload in another.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: key-rotation-controller
|
|
rules:
|
|
- apiGroups: ["iam.homelab.riotpiao.com"]
|
|
resources: ["keyrotations"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["iam.homelab.riotpiao.com"]
|
|
resources: ["keyrotations/status"]
|
|
verbs: ["get", "update", "patch"]
|
|
# The controller writes the credential it just created. list and watch are needed
|
|
# because the manager caches Secrets; without them the cache cannot start and
|
|
# every reconcile fails.
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
# Rolling a consumer that cannot hot reload.
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments", "statefulsets"]
|
|
verbs: ["get", "list", "watch", "patch"]
|
|
# Leader election. Without this the controller cannot acquire its Lease and never
|
|
# starts reconciling.
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: key-rotation-controller
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: key-rotation-controller
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: key-rotation-controller
|
|
namespace: iam
|