Skip to content

pxc-operator helm chart misses the certificates/status grant in the RBAC rules #928

Description

@wonko

In the operator itself (https://raw.githubusercontent.com/percona/percona-xtradb-cluster-operator/v1.20.0/deploy/rbac.yaml), the section on cert-manager has

- apiGroups:
  - certmanager.k8s.io
  - cert-manager.io
  resources:
  - issuers
  - certificates
  - certificates/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
  - deletecollection

but the chart is missing the "certificates/status" resource (see https://github.com/percona/percona-helm-charts/blob/main/charts/pxc-operator/templates/role.yaml#L133) , resulting in errors along the lines of

failed to reconcile SSL. Please create your TLS secret XXXXXXX-pxc-db-ssl and XXXXXX-pxc-db-ssl-internal manually or setup cert-manager correctly: reconcile CA rotation: update certificate status XXXXXX-pxc-db-ssl: certificates.cert-manager.io \"XXXXXX-pxc-db-ssl\" is forbidden: User \"system:serviceaccount:percona:pxc-operator\" cannot update resource \"certificates/status\" in API group \"cert-manager.io\" in the namespace \"percona\"

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions