From 0045ef5294a85857c4784bc3665799e5b0a5f03d Mon Sep 17 00:00:00 2001 From: Jan Chaloupka Date: Mon, 26 Feb 2024 13:57:33 +0100 Subject: [PATCH] system:kube-scheduler: extend the RBAC with pods/finalizers When enabling DynamicResourceAllocation the dynamicresource plugin may error during scheduling with: ``` E0212 08:57:53.817268 1 framework.go:1323] "Plugin failed" err="podschedulingcontexts.resource.k8s.io \"pod\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , " plugin="DynamicResources" pod="gpu-test2/pod" ``` --- plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go | 1 + 1 file changed, 1 insertion(+) diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go index e9eb1f84c1f..496d3d80b10 100644 --- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go @@ -580,6 +580,7 @@ func ClusterRoles() []rbacv1.ClusterRole { rbacv1helpers.NewRule(ReadUpdate...).Groups(resourceGroup).Resources("resourceclaims/status").RuleOrDie(), rbacv1helpers.NewRule(ReadWrite...).Groups(resourceGroup).Resources("podschedulingcontexts").RuleOrDie(), rbacv1helpers.NewRule(Read...).Groups(resourceGroup).Resources("podschedulingcontexts/status").RuleOrDie(), + rbacv1helpers.NewRule(ReadUpdate...).Groups(legacyGroup).Resources("pods/finalizers").RuleOrDie(), ) } roles = append(roles, rbacv1.ClusterRole{