Repository navigation
Fix Role & RoleBinding creation with OwnerReferencesPermissionEnforcement enabled #464
Description
On Kubernetes Environments where the OwnerReferencesPermissionEnforcement admission controller plugin is enabled, the barman cloud plugin fails to create the role and roleBindings with below error:
cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on
This happens because the plugin configures the Cluster in the OwnerReferences with the BlockOwnerDeletion flag enabled. When OwnerReferencesPermissionEnforcement is enabled this operation requires the permission to modify the finalizers on the referenced resource.
Activity
dosubot commentedon Aug 8, 2025
Hi @GabriFedi97! I'm Dosu and I’m helping the plugin-barman-cloud team.
The error occurs because the plugin sets the Cluster as an OwnerReference with
BlockOwnerDeletionenabled, which requires update permission on thefinalizerssubresource of the Cluster resource when the OwnerReferencesPermissionEnforcement admission controller is active. To fix this, add the following permission to the ClusterRole used by the Barman plugin:This change should be applied in both the Helm chart and any manual RBAC manifests for the plugin, especially in OpenShift or OKD environments where this admission controller is enabled. For more details and context, see this discussion.
To reply, just mention @dosu.
Docs are dead. Just use Dosu.