GoogleContainerTools / GoogleContainerTools/skaffold
Skaffold >=1.35 failed to finish deployment if user doesn't have access to list StatefullSets
- Dominant language
- Go
- Stars
- 15.9k
- Forks
- 1.7k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 10
Description
### Expected behavior
`skaffold run` successfully deploy pod or deployment when user doesn't have access to list stateful sets
### Actual behavior
If `skaffold run` executed by user that has no access to list stateful sets.
Then status check failed and exits with error message like this:
```
could not fetch statefulsets: could not fetch stateful sets: statefulsets.apps is forbidden: User "engineer" cannot list resource "statefulsets" in API group "apps" in the namespace "platform"
```
### Information
- Skaffold version: v1.35.1
- Operating system: macOS 11.6.1
- Installed via: Homebrew
- Contents of skaffold.yaml:
```yaml
apiVersion: skaffold/v2beta26
kind: Config
build:
artifacts:
- image: skaffold-example
deploy:
kubectl:
manifests:
- k8s-*
```
### Steps to reproduce the behavior
1. Setup k8s cluster
2. Create user that has no access to list stateful sets
3. Set kubectx to use user from step 2
4. git clone --depth 1 https://github.com/GoogleContainerTools/skaffold
5. cd skaffold/examples/getting-started
6. `skaffold run`
Notes:
* change that brings issue https://github.com/GoogleContainerTools/skaffold/commit/8f67e8d4bc5e7117eea45d0a63982aa311147f6a#diff-3f3b4b2f9bde6d865f17be301760aa1f5ec701f66ea7091a3513c2e58f5c2b6f
* related to #6361
* Can we not check stateful set if it was not used in redered files?
Workaround:
* run any skaffold command with `--status-check=false`
Contributor guide
Assessment
This issue has not been assessed yet.