gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix vault-restore RBAC: add watch verb for kubectl wait

Browse Source 
Without it, kubectl wait's internal watch retry loop never terminates
cleanly even with --timeout set - confirmed live, it kept retrying well
past the stated 120s timeout. The restore/unseal steps themselves still
succeed regardless (verified end-to-end with a manual unseal), this only
affects the job's own graceful detection of the pod coming back.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-17 21:54:21 -05:00
co-authored by Claude Sonnet 5
parent e2bdab8940
commit fb124201bb
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
+7 -1
View File
@@ -35,7 +35,13 @@ metadata:
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["pods"] resources: ["pods"]
verbs: ["get", "list", "delete"] # watch is required by `kubectl wait` - without it the wait's internal
# watch retry loop never terminates cleanly even with --timeout set
# (confirmed live 2026-08-18: it just kept retrying past the stated
# 120s timeout). The restore/unseal steps themselves still succeed
# without it - this only affects how gracefully the job detects the
# pod coming back before unsealing.
verbs: ["get", "list", "watch", "delete"]
- apiGroups: [""] - apiGroups: [""]
resources: ["pods/exec"] resources: ["pods/exec"]
verbs: ["create"] verbs: ["create"]