Bring back configmap RBAC permissions by ViliusS · Pull Request #1019 · kubernetes-sigs/metrics-server

ViliusS · 2022-05-04T15:22:16Z

What this PR does / why we need it:
This change 4a65c6a doesn't allow to run metrics-server in a separate namespace anymore.

Bring back at least configmap permissions to allow for extension-apiserver-authentication::client-ca-file retrieval.

This change kubernetes-sigs@4a65c6a doesn't allow to run metrics-server in a separate namespace anymore. Bring back at least configmap permissions to allow for extension-apiserver-authentication::client-ca-file retrieval.

linux-foundation-easycla · 2022-05-04T15:22:19Z

The committers listed above are authorized under a signed CLA.

✅ login: ViliusS / name: Vilius Šumskas (1677572)

k8s-ci-robot · 2022-05-04T15:22:24Z

Welcome @ViliusS!

It looks like this is your first PR to kubernetes-sigs/metrics-server 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/metrics-server has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2022-05-04T15:22:25Z

Hi @ViliusS. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2022-05-04T15:22:28Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ViliusS
To complete the pull request process, please assign serathius after the PR has been reviewed.
You can assign the PR to them by writing /assign @serathius in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

serathius · 2022-05-04T15:24:08Z

Running metrics-server in different namespace than "kube-system" is not supported in official manifests.

ViliusS · 2022-05-04T15:31:40Z

Running metrics-server in different namespace than "kube-system" is not supported in official manifests.

Even if it is so, previous change breaks compatibility.

BTW, we were using metrics-server in different namespace for the past 2 years without issues. With this commit, we can use it again.

serathius · 2022-05-04T17:58:49Z

Breaking change cannot be breaking if the behavior that was broken was never officially supported.

I would need to see much more user impact to consider users using different namespace as valid use case. Users are free to modify official manifests, but this means they are expected to maintain the changes themselves. We just don't have enough capacity to support and test all possible configurations.

You might want to consider using official Helm chart as it supports running in different namespace.

ViliusS · 2022-05-04T18:23:46Z

Not sure how helm chart is built, but it looks like template still contains the same permission I'm proposing to bring back in manifest

metrics-server/charts/metrics-server/templates/clusterrole.yaml

Line 21 in cd7cd4a

- configmaps

Maybe this is why metrics-server installed via Helm works.

k8s-triage-robot · 2022-08-02T18:50:09Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2022-08-03T06:04:01Z

/remove-lifecycle stale

k8s-triage-robot · 2022-11-01T06:53:03Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2022-11-01T08:12:02Z

/remove-lifecycle stale

k8s-triage-robot · 2023-01-30T09:04:26Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2023-01-30T09:26:39Z

/remove-lifecycle stale

k8s-triage-robot · 2023-04-30T09:32:53Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot · 2024-11-26T11:31:12Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2024-11-26T11:32:28Z

/remove-lifecycle stale

k8s-triage-robot · 2025-02-24T11:40:14Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2025-02-24T11:41:24Z

/remove-lifecycle stale

k8s-triage-robot · 2025-05-25T12:04:56Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2025-05-26T08:03:05Z

/remove-lifecycle stale

k8s-triage-robot · 2025-08-24T08:19:59Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2025-08-25T05:30:42Z

/remove-lifecycle stale

k8s-triage-robot · 2025-11-23T06:31:18Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2025-11-23T16:58:34Z

/remove-lifecycle stale

k8s-triage-robot · 2026-02-21T17:17:15Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2026-02-21T20:42:38Z

/remove-lifecycle stale

k8s-triage-robot · 2026-05-22T21:12:42Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

ViliusS · 2026-05-22T22:31:12Z

/remove-lifecycle stale

Bring back configmap RBAC permissions

1677572

This change kubernetes-sigs@4a65c6a doesn't allow to run metrics-server in a separate namespace anymore. Bring back at least configmap permissions to allow for extension-apiserver-authentication::client-ca-file retrieval.

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label May 4, 2022

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 4, 2022

k8s-ci-robot requested review from dgrisonnet and serathius May 4, 2022 15:22

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label May 4, 2022

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels May 4, 2022

CrisNevares mentioned this pull request Jun 10, 2022

Minimize RBAC permissions #1040

Open

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 2, 2022

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 3, 2022

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 1, 2022

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 1, 2022

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 30, 2023

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 30, 2023

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 26, 2024

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 26, 2024

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 24, 2025

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 24, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 25, 2025

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 26, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 24, 2025

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 25, 2025

rexagod added this to SIG Instrumentation Aug 30, 2025

rexagod moved this to Needs Review (PR) or SIG Response (Issue) in SIG Instrumentation Aug 30, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 23, 2025

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 23, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 21, 2026

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 21, 2026

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 22, 2026

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 22, 2026

Uh oh!

Conversation

ViliusS commented May 4, 2022

Uh oh!

linux-foundation-easycla Bot commented May 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented May 4, 2022

Uh oh!

k8s-ci-robot commented May 4, 2022

Uh oh!

k8s-ci-robot commented May 4, 2022

Uh oh!

serathius commented May 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ViliusS commented May 4, 2022

Uh oh!

serathius commented May 4, 2022

Uh oh!

ViliusS commented May 4, 2022

Uh oh!

k8s-triage-robot commented Aug 2, 2022

Uh oh!

ViliusS commented Aug 3, 2022

Uh oh!

k8s-triage-robot commented Nov 1, 2022

Uh oh!

ViliusS commented Nov 1, 2022

Uh oh!

k8s-triage-robot commented Jan 30, 2023

Uh oh!

ViliusS commented Jan 30, 2023

Uh oh!

k8s-triage-robot commented Apr 30, 2023

Uh oh!

k8s-triage-robot commented Nov 26, 2024

Uh oh!

ViliusS commented Nov 26, 2024

Uh oh!

k8s-triage-robot commented Feb 24, 2025

Uh oh!

ViliusS commented Feb 24, 2025

Uh oh!

k8s-triage-robot commented May 25, 2025

Uh oh!

ViliusS commented May 26, 2025

Uh oh!

k8s-triage-robot commented Aug 24, 2025

Uh oh!

ViliusS commented Aug 25, 2025

Uh oh!

k8s-triage-robot commented Nov 23, 2025

Uh oh!

ViliusS commented Nov 23, 2025

Uh oh!

k8s-triage-robot commented Feb 21, 2026

Uh oh!

ViliusS commented Feb 21, 2026

Uh oh!

k8s-triage-robot commented May 22, 2026

Uh oh!

ViliusS commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

linux-foundation-easycla Bot commented May 4, 2022 •

edited

Loading

serathius commented May 4, 2022 •

edited

Loading