Add Necessary Access to roles and rolebindings in the rbac.authorization.k8s.io API Group

[artntek]

Goal

Modify application-context.yaml to add necessary access (i.e. kubectl get, create, and delete) to roles and rolebindings in the rbac.authorization.k8s.io API Group, so it will apply to all new accounts.

Explanation

Default permissions for service account roles currently do not include sufficient access to roles and rolebindings in rbac.authorization.k8s.io.

This access is required in order to install, upgrade and delete some 3rd party helm charts; for example, the bitnami RabbitMQ chart installation currently fails, with:

  Error: INSTALLATION FAILED: Unable to continue with install: could not get information about the resource
  Role "metacatbrooke-rabbitmq-endpoint-reader" in namespace "brooke": roles.rbac.authorization.k8s.io
  "metacatbrooke-rabbitmq-endpoint-reader" is forbidden: User "system:serviceaccount:brooke:brooke"
  cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "brooke"

Workarounds include manually editing the role for the service account in question, or using the admin service account to install/upgrade/delete (bad practice).

Default permissions are here: application-context.yaml

GitHub DataONE K8s repo for reference

[mbjones]

Completed in PR #49 - closing. New service accounts will now have this permission, but existing SAs will need to be manually updated with the new permission.

[artntek]

I was wrong - role also needs create and delete in order to work across the whole helm lifecycle for bitnami rabbitmq chart. description updated above