{"action":"created","issue":{"url":"https://api.github.com/repos/teamhephy/registry-token-refresher/issues/3","repository_url":"https://api.github.com/repos/teamhephy/registry-token-refresher","labels_url":"https://api.github.com/repos/teamhephy/registry-token-refresher/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/teamhephy/registry-token-refresher/issues/3/comments","events_url":"https://api.github.com/repos/teamhephy/registry-token-refresher/issues/3/events","html_url":"https://github.com/teamhephy/registry-token-refresher/issues/3","id":327531810,"node_id":"MDU6SXNzdWUzMjc1MzE4MTA=","number":3,"title":"Token Refresher needs a ServiceAccount to list namespaces","user":{"login":"kingdonb","id":3286998,"node_id":"MDQ6VXNlcjMyODY5OTg=","avatar_url":"https://avatars2.githubusercontent.com/u/3286998?v=4","gravatar_id":"","url":"https://api.github.com/users/kingdonb","html_url":"https://github.com/kingdonb","followers_url":"https://api.github.com/users/kingdonb/followers","following_url":"https://api.github.com/users/kingdonb/following{/other_user}","gists_url":"https://api.github.com/users/kingdonb/gists{/gist_id}","starred_url":"https://api.github.com/users/kingdonb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingdonb/subscriptions","organizations_url":"https://api.github.com/users/kingdonb/orgs","repos_url":"https://api.github.com/users/kingdonb/repos","events_url":"https://api.github.com/users/kingdonb/events{/privacy}","received_events_url":"https://api.github.com/users/kingdonb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-30T00:27:50Z","updated_at":"2018-09-04T12:45:03Z","closed_at":null,"author_association":"MEMBER","body":"The registry-token-refresher deployment needs a service account to refresh tokens for ECR (and other externally provided registry services, I presume).\r\n\r\nThe SA should get bound (ClusterRoleBinding) to a role that has permission to list namespaces, like this:\r\n\r\n```\r\nrules:\r\n- apiGroups: [\"\"]\r\n  resources: [\"namespaces\"]\r\n  verbs: [\"list\"]\r\n```\r\n\r\nand the ServiceAccount needs to be linked to the pod in the `registry-token-refresher` deployment's pod `template.spec`, like:\r\n\r\n```\r\nspec:\r\n  template:\r\n    spec:\r\n      serviceAccount: deis-registry-token-refresher\r\n```\r\n\r\nThat ServiceAccount needs to be created as well, since registry-token-refresher evidently didn't need any SA until RBAC in k8s 1.9\r\n\r\n@bit-herder found this"},"comment":{"url":"https://api.github.com/repos/teamhephy/registry-token-refresher/issues/comments/418353057","html_url":"https://github.com/teamhephy/registry-token-refresher/issues/3#issuecomment-418353057","issue_url":"https://api.github.com/repos/teamhephy/registry-token-refresher/issues/3","id":418353057,"node_id":"MDEyOklzc3VlQ29tbWVudDQxODM1MzA1Nw==","user":{"login":"edisonwang","id":282996,"node_id":"MDQ6VXNlcjI4Mjk5Ng==","avatar_url":"https://avatars0.githubusercontent.com/u/282996?v=4","gravatar_id":"","url":"https://api.github.com/users/edisonwang","html_url":"https://github.com/edisonwang","followers_url":"https://api.github.com/users/edisonwang/followers","following_url":"https://api.github.com/users/edisonwang/following{/other_user}","gists_url":"https://api.github.com/users/edisonwang/gists{/gist_id}","starred_url":"https://api.github.com/users/edisonwang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edisonwang/subscriptions","organizations_url":"https://api.github.com/users/edisonwang/orgs","repos_url":"https://api.github.com/users/edisonwang/repos","events_url":"https://api.github.com/users/edisonwang/events{/privacy}","received_events_url":"https://api.github.com/users/edisonwang/received_events","type":"User","site_admin":false},"created_at":"2018-09-04T12:45:03Z","updated_at":"2018-09-04T12:45:03Z","author_association":"NONE","body":"Hi, \r\nI just run into this as well.... is there any instruction so that I can grant permission safely to such service account? \r\n\r\nCurrent error log:\r\n\r\n```\r\n2018/09/04 11:32:00 Error getting kubernetes namespaces namespaces is forbidden: User \"system:serviceaccount:deis:default\" cannot list namespaces at the cluster scope\r\n```\r\n\r\nThanks."}}
{"actor":{"display_login":"edisonwang"}}