Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Latest UXP version broke RBAC in provider e2e tests #442

Open
mbbush opened this issue Mar 1, 2024 · 1 comment
Open

Latest UXP version broke RBAC in provider e2e tests #442

mbbush opened this issue Mar 1, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@mbbush
Copy link

mbbush commented Mar 1, 2024

What happened?

I noticed that all the e2e tests in provider-aws were failing, even ones that had previously been passing on the exact same commit.

I traced the issue down to the common build module passing an empty UXP_VERSION parameter to up uxp install, which then installs the latest version, which was released yesterday.

This shows up in the provider logs, and doesn't go away, even if the provider runs for tens of minutes:

E0301 22:54:16.207615       1 reflector.go:147] k8s.io/[email protected]/tools/cache/reflector.go:229: Failed to watch *v1beta1.ProviderConfig: failed to list *v1beta1.ProviderConfig: providerconfigs.aws.upbound.io is forbidden: User "system:serviceaccount:upbound-system:provider-aws-iam-provider-aws" cannot list resource "providerconfigs" in API group "aws.upbound.io" at the cluster scope

How can we reproduce it?

Run any of the e2e tests in upbound provider-aws.

To revert, add export UXP_VERSION := 1.14.6-up.1 to the Makefile, delete your kind cluster, and start over, and now the tests pass.

What environment did it happen in?

UXP version: 1.15.0-up.1

I haven't tried installing UXP 1.15 on any real clusters yet, so I don't know if the issue is a test-only problem, or the test config needs to be updated, or if it's a real bug in UXP. I also haven't tried running the tests with upstream crossplane.

@mbbush
Copy link
Author

mbbush commented Mar 4, 2024

My best guess as to what is going on is that something about the way the e2e tests copy the providers into the crossplane pod is causing the RBAC manager to decide that they're not part of the same family.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant