From 6878aac95086d33511462a8034fe8df759fd27da Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Mon, 15 Jun 2026 22:36:25 +0200 Subject: [PATCH] fix(ci): grant ci-deploy SA serviceaccounts/pvc/cronjobs + deployments-watch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fxhnt-cockpit deploy step applies manifests containing ServiceAccounts (dashboard/dagster), a PVC (forward track), and a CronJob — none of which the ci-deploy Role permitted, so kubectl apply failed partway. Also added 'watch' on deployments for 'kubectl rollout status'. Surfaced once the cockpit deploy finally ran (it previously died at the MinIO log sink first). Rule: this Role must gain a grant for every new resource KIND a deployed manifest introduces. Co-Authored-By: Claude Opus 4.8 (1M context) --- infra/k8s/argo/ci-deploy-rbac.yaml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/infra/k8s/argo/ci-deploy-rbac.yaml b/infra/k8s/argo/ci-deploy-rbac.yaml index 5aff8cef5..c41ac8ac5 100644 --- a/infra/k8s/argo/ci-deploy-rbac.yaml +++ b/infra/k8s/argo/ci-deploy-rbac.yaml @@ -7,18 +7,25 @@ metadata: labels: app.kubernetes.io/part-of: foxhunt rules: + # apps: roll + apply Deployments. watch is required by `kubectl rollout status`. - apiGroups: ["apps"] resources: [deployments] - verbs: [get, list, patch] + verbs: [get, list, watch, patch] - apiGroups: ["argoproj.io"] resources: [workflowtemplates, eventsources, sensors, eventbus] verbs: [get, list, create, update, patch] + # core: services/configmaps, plus serviceaccounts (tailscale-dashboard, dagster) and the forward-track PVC + # — added so the fxhnt-cockpit deploy can `kubectl apply` its full manifest set without a partial-apply failure. - apiGroups: [""] - resources: [services, configmaps] + resources: [services, configmaps, serviceaccounts, persistentvolumeclaims] verbs: [get, list, create, update, patch] - apiGroups: ["networking.k8s.io"] resources: [networkpolicies] verbs: [get, list, create, update, patch] + # batch: the fxhnt-forward CronJob + - apiGroups: ["batch"] + resources: [cronjobs] + verbs: [get, list, create, update, patch] - apiGroups: ["rbac.authorization.k8s.io"] resources: [roles, rolebindings] verbs: [get, list, create, update, patch, bind, escalate]