Without cluster-admin, the controller-manager cannot read HelmRegistry and OCIRegistry objects

Behavior#

The controller-manager watches HelmRegistry and OCIRegistry objects. The ClusterRole convoy-controller-manager in the Helm chart and in the kustomize base does not give access to the resources helmregistries, ociregistries and their status subresources. The ClusterRole of the observer gives this access.

With the default settings, the chart value rbac.clusterAdminApply and the kustomize component cluster-admin-apply bind cluster-admin to the controller-manager. This binding hides the missing rules.

Effect#

Production settings tells you to remove the cluster-admin binding. Without it, the host cluster refuses the list and watch requests of the controller-manager for these two kinds. Then:

• The controllers of HelmRegistry and OCIRegistry do not start, so these objects get no status.
• A Release with spec.source.helmRegistry or spec.source.ociRegistry does not render. It reports Applied=False with reason SourceNotReady and the message source HelmRegistry <namespace>/<name> not found, or the same message for OCIRegistry. convoy retries.

Releases from a GitRepository are not affected. This effect comes from the code. It is not reproduced on a cluster.

Workaround#

Keep the cluster-admin binding, or apply this ClusterRole and ClusterRoleBinding. Change convoy-system if you installed the chart in a different namespace.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: convoy-controller-manager-registries
rules:
  - apiGroups: ["source.convoy.kumodo.io"]
    resources: ["helmregistries", "ociregistries"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["source.convoy.kumodo.io"]
    resources: ["helmregistries/status", "ociregistries/status"]
    verbs: ["get", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: convoy-controller-manager-registries
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: convoy-controller-manager-registries
subjects:
  - kind: ServiceAccount
    name: convoy-controller-manager
    namespace: convoy-system

Fix direction#

Add the two rules to the ClusterRole convoy-controller-manager in the chart and in the kustomize base. Add a chart test that compares the rules with the informers of the controller-manager.