fix: update rbac to support modern event recorder events.k8s.io - #52
Conversation
…y with the old one
|
Hey @stubbi, this is my first contribution to a public repo, I found this little issue when using the provider on my cluster. (thanks a lot for open sourcing it!) Let me know if anything is not following the guidelines or if a change is required. |
stubbi
left a comment
stubbi
left a comment
There was a problem hiding this comment.
Verified against the code: pkg/controllers/nodeclass/controller.go:193 uses m.GetEventRecorder(), which returns a k8s.io/client-go/tools/events recorder writing events.k8s.io Events — the chart only granted the core "" group, so the forbidden error is real. Keeping "" for karpenter core's legacy recorder is right, and create+patch on both groups matches what the new recorder needs for event series. CI is green apart from govulncheck, which fails on stdlib vulns fixed on main by #57 — a rerun after that merges clears it. Chart version bump can ride the next release chore.
Awesome, I updated the branch to get #57 but I guess it was not really needed, just need to re-run the CI. Thank you! |
Chart 2.1.1 / appVersion 2.1.1. Ships the events.k8s.io RBAC grant (#52), the Go 1.26.7 toolchain rebuild clearing five stdlib CVEs (#57), and dependency bumps (karpenter 1.14.1, hcloud-go 2.47.0, k8s.io 0.36.4) (#58). Claude-Session: https://claude.ai/code/session_01FJnTGiMuTJSFUVRRqjfTbV Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2 participants
Summary
The Helm chart RBAC was only granting event write access to the core API group (""). However in the codebase the controller-runtime
c.recorder = m.GetEventRecorder(c.Name())is calling the new api group underevents.k8s.io. This lead to the controller emitting errors like the below one:I kept the group "" in the RBAC because the karpenter package upstream is still using the old legacy events api in some places like
mgr.GetEventRecorderFor("karpenter")in https://github.com/kubernetes-sigs/karpenter/blob/2266468104f36373ed002241afaee2d3bbc26078/pkg/controllers/controllers.go.Changes
rbac.yamlto allow to emit event with the new recorder APIVerification
make testpassesmake lintpassesmake generate-verifypasses (CRD/deepcopy up to date)