Repository navigation
Grant fake-workersync the controller authz role so it can manage Workers - #2885
Conversation
ate-api-server grants the controller role, which lists, registers and deletes Workers, only to --controller-spiffe-id, ate-controller's identity by default. On a --fake-data-plane install fake-workersync manages Workers in ate-controller's place under its own identity, so under enforced authorization it was denied listing Workers and exited, and the install never became ready. The fake-data-plane component now names fake-workersync as the controller.
edb7efe to
71b1057
Compare
haiyanmeng
changed the title
| patch: |- | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/args/- | ||
| value: --controller-spiffe-id=spiffe://cluster.local/ns/ate-system/sa/fake-workersync |
There was a problem hiding this comment.
🤖 should-fix 🟡 – The controller role doesn't cover every RPC fake-workersync calls. When a pool scales down, retire (cmd/benchmarking/isolate/fake-workersync/controller.go:519) calls ListWorkerActorAssignments, which needs can_list_actor_assignments. In model.fga only viewer has that permission, not controller. Under enforced authorization the call is denied, so retired Workers stay drained and are never deleted. The real ate-controller never makes this call. I'd drop the call from retire rather than widen the production controller role: delete the Worker after drainGrace, since DeleteWorker already releases any Actors still assigned.
There was a problem hiding this comment.
Julian Gutierrez Oschmann (@juli4n) , Max Smythe (@maxsmythe) , I will drop the ListWorkerActorAssignments call from fake-workersync in a followup PR.
ate-api-server grants the controller role (list, register and delete Workers) only to
--controller-spiffe-id, which by default is ate-controller's identity. On a--fake-data-planeinstall, fake-workersync manages Workers in place of ate-controller, using its own identity. With authorization enforced, it was denied listing Workers and exited, so the install never became ready.The fake-data-plane kustomize component now sets fake-workersync as the controller identity.