Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possibility to run service-index without RBAC #43

Open
maximilian-mueller67 opened this issue Apr 3, 2023 · 2 comments
Open

Possibility to run service-index without RBAC #43

maximilian-mueller67 opened this issue Apr 3, 2023 · 2 comments

Comments

@maximilian-mueller67
Copy link

Hi,
we deployed report portal within Kubernetes and since we cannot enable RBAC due to security reasons we disabled it (see below). It works - except that the two things:

  1. Auto analysis not working - also the buttons Project Settings -> Auto Analysis -> remove/generate index are grayed out. It says that the analyzer service is not running, but it certainly is. See logs:
    2023/04/03 07:14:04 "GET http://OUR_RP_INSTANCE/composite/info HTTP/1.1" from IP - 200 3B in 6.891609ms time="2023-04-03T07:14:04Z" level=error msg="Unable to aggregate node information: unable to aggregate nodes info: services is forbidden: User \"system:serviceaccount:USER: default\" cannot list resource \"services\" in API group \"\" in the namespace \"NAMESPACE\""

  2. On the login page where you normally see the versions of all services, nothing is shown.

This very much limits the functionality of rp if we cannot use the auto analyser.

Now the question is can we disable rbac without compromising functionality? I also thought maybe we could clone this repo and just hard code it so every service shows as healthy.

values.yaml that we have right now (removed also the service account):

## RBAC is required for service-index in order to collect status/info over all services
rbac:
  create: false

Help would be very much appreciated!
@HardNorth @avarabyeu

@bond-
Copy link
Contributor

bond- commented Aug 10, 2023

looks like reportportal needs to create a role and rolebinding for the service account in the helm chart

@avarabyeu
Copy link
Member

As per my understanding RBAC is enabled in your cluster, but you are not allowed to create service account.
This particular service is responsible to aggregation of health check and version information that you see on your login page. Plus couple of basic redirects which could be important.
In your case i would consider contributing some NopAggregator implementation that does nothing (e.g. doesn't go to k8s api in order to get services statuses).
main.go:53

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants