Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-1937

Deleting a QuayRegistry does not work. Operator SA has too few permissions

XMLWordPrintable

    • 0

      When deleting a QuayRegistry that the operator set up the operator gets called because of the finalizer in the QuayRegistry resource.

      However the Operator's Service Account doesn't have permission to list namespaces which results in this error looping:

      2021-04-28T20:56:13.108Z INFO controllers.QuayRegistry `QuayRegistry` to be deleted {"quayregistry": "quay-wk/quay"}
      2021-04-28T20:56:13.108Z INFO controllers.QuayRegistry cleaning up namespace labels
      E0428 20:56:13.112234 1 reflector.go:153] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:224: Failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:quay-wk:quay-operator" cannot list resource "namespaces" in API group "" at the cluster scope
      E0428 20:56:14.114435 1 reflector.go:153] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:224: Failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:quay-wk:quay-operator" cannot list resource "namespaces" in API group "" at the cluster scope

            rhn-coreos-amerdler Alec Merdler (Inactive)
            wkulhanek Wolfgang Kulhanek
            luffy zhang luffy zhang
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: