airbytehq / airbytehq/airbyte

Unable to create pods after upgrade to 0.63.11 due to missing role/binding

未關閉
#42,859 21 則留言 5 個 reaction 已指派 0 人 在 GitHub 檢視
area/platform community helm team/deployments type/bug
主要語言
Python
星號
22.1k
分支
5.4k
平均合併
5 小時
30 天內合併 PR
671

描述

### Helm Chart Version

0.350.0

### What step the error happened?

Upgrading the Platform or Helm Chart

### Relevant information

New App version: 0.63.11
Prior App Version: 0.63.9
Platform: GKE (Autopilot cluster)

Everything upgraded fine, but when trying to check or sync connections, we started getting errors like `Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:airbyte-ns:REDACTED" cannot list resource "pods" in API group "" in the namespace "airbyte-ns"`, `Guest attributes endpoint access is disabled`, and `"403 Forbidden" for request "PUT http://metadata.google.internal/computeMetadata/v1/instance/guest-attributes/guestInventory/Hostname"`

It seems similar to some past threads:
- https://github.com/airbytehq/airbyte/issues/7211
- https://airbytehq.slack.com/archives/C02MHKUE4BC/p1652468746315379

I do already have all these set in config:
```
global:
serviceAccountName: REDACTED

serviceAccount:
create: true
name: REDACTED
```

It seems like there may be a missing role binding or something along those lines. For what it's worth, we're using GKE Autopilot and a non-default service account (meaning not the default one provisioned for the cluster, and also not named `airbyte-admin`.

As a workaround, I granted our SA roles/container.clusterAdmin—but it really shouldn't need these permissions to create pods in its own deployments.

I saw another user reported a similar issue in [this Slack thread](https://airbytehq.slack.com/archives/C01AHCD885S/p1722275928772259).

### Relevant log output

_No response_

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。