GoogleContainerTools / GoogleContainerTools/skaffold

Skaffold >=1.35 failed to finish deployment if user doesn't have access to list StatefullSets

Open
#6,975 1 comment 0 reactions 0 assignees View on GitHub
area/status-check kind/bug priority/p3
Dominant language
Go
Stars
15.9k
Forks
1.7k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

### Expected behavior
`skaffold run` successfully deploy pod or deployment when user doesn't have access to list stateful sets

### Actual behavior
If `skaffold run` executed by user that has no access to list stateful sets.
Then status check failed and exits with error message like this:
```
could not fetch statefulsets: could not fetch stateful sets: statefulsets.apps is forbidden: User "engineer" cannot list resource "statefulsets" in API group "apps" in the namespace "platform"
```

### Information

- Skaffold version: v1.35.1
- Operating system: macOS 11.6.1
- Installed via: Homebrew
- Contents of skaffold.yaml:

```yaml
apiVersion: skaffold/v2beta26
kind: Config
build:
artifacts:
- image: skaffold-example
deploy:
kubectl:
manifests:
- k8s-*
```

### Steps to reproduce the behavior

1. Setup k8s cluster
2. Create user that has no access to list stateful sets
3. Set kubectx to use user from step 2
4. git clone --depth 1 https://github.com/GoogleContainerTools/skaffold
5. cd skaffold/examples/getting-started
6. `skaffold run`

Notes:
* change that brings issue https://github.com/GoogleContainerTools/skaffold/commit/8f67e8d4bc5e7117eea45d0a63982aa311147f6a#diff-3f3b4b2f9bde6d865f17be301760aa1f5ec701f66ea7091a3513c2e58f5c2b6f
* related to #6361
* Can we not check stateful set if it was not used in redered files?

Workaround:
* run any skaffold command with `--status-check=false`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.