Skip to content

Commit 5e67f84

Browse files
Fix e2e test RBAC: add bind/escalate verbs
Scoped ServiceAccount clients need `bind` and `escalate` verbs to create ClusterRoleBindings. The admin client previously used bypassed this RBAC requirement. The documentation (docs/concepts/permission-model.md) already specifies that ServiceAccounts need `bind` and `escalate` verbs for RBAC resources to install extensions with their own RBAC. The e2e test template was missing these verbs, causing tests to fail when using scoped ServiceAccount clients (which properly enforce Kubernetes RBAC) instead of the admin client.
1 parent 2a2d85c commit 5e67f84

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

test/e2e/steps/testdata/rbac-template.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ rules:
5050
- roles
5151
- clusterrolebindings
5252
- rolebindings
53-
verbs: [ update, create, list, watch, get, delete, patch ]
53+
verbs: [ update, create, list, watch, get, delete, patch, bind, escalate ]
5454
- apiGroups: ["coordination.k8s.io"]
5555
resources: ["leases"]
5656
verbs: [ update, create, list, watch, get, delete, patch ]

0 commit comments

Comments
 (0)