Kubernetes Discovery Without ClusterRole

[aldycool]

Description

Hi, is it possible to deploy Homepage to K8s without the need to also create ClusterRole as instructed in the Kubernetes Installation Doc? We're having some restriction conflicts in our environment (we cannot create ClusterRoles) due to policies in-place.

At per writing, this is not possible, but I've narrowed down the issue to this line:

homepage/src/utils/config/service-helpers.js

Lines 196 to 202 in 7e50da8

	const ingressList = await networking
	.listIngressForAllNamespaces(null, null, null, null)
	.then((response) => response.body)
	.catch((error) => {
	logger.error("Error getting ingresses: %d %s %s", error.statusCode, error.body, error.response);
	return null;
	});

Which produces the error below:

[2024-06-03T10:44:39.177Z] error: <service-helpers> Error getting ingresses: 403 {
  kind: 'Status',
  apiVersion: 'v1',
  metadata: {},
  status: 'Failure',
  message: 'ingresses.networking.k8s.io is forbidden: User "system:serviceaccount:sysdev-homepage-frontend:homepage" cannot list resource "ingresses" in API group "networking.k8s.io" at the cluster scope',
  reason: 'Forbidden',
  details: [Object],
  code: 403
}

To remediate this, how about if we enumerate all accessible namespaces first, and then get the ingresses from those namespaces? I'm not very familiar with Kubernetes Client in NodeJS, I'm not sure if there's any built-in functions that can directly do this without manual enumeration.

Thanks.

homepage version

v0.8.13 (986a181, May 6, 2024)

Installation method

Other (please describe above)

Configuration

No response

Container Logs

No response

Browser Logs

No response

Troubleshooting

No troubleshooting needed

[glime-ai[bot]]

Thanks for posting a discussion about homepage here on GitHub. Homepage now uses a fancy new AI tool thanks to our friends at Glime, so the answer below is the AI bot's attempt to answer your question. If you feel it's sufficient you can mark the answer and close this post, otherwise feel free to leave it open of course!

Thanks for using Homepage! ❤️

---

Hi,

Based on the information provided and the context from the documentation, it seems that the Homepage application requires certain permissions to list resources at the cluster scope, which is why it's trying to create a ClusterRole. If your environment restricts the creation of ClusterRoles, you might consider a couple of alternatives:

1. Namespace-specific roles: Instead of a ClusterRole, you could create a Role within a specific namespace that grants the necessary permissions. This would limit the scope of the permissions to the namespace and might comply with your environment's policies. However, this would also limit the Homepage application to only monitor resources within that namespace.

2. Manual enumeration: As you suggested, you could modify the application code to first enumerate all accessible namespaces and then get the ingresses from those namespaces. This would require changes to the application logic and might not be straightforward without a good understanding of the Kubernetes Client library in NodeJS.

3. Custom service account: If the service account used by the Homepage application has limited permissions, you could create a custom service account with the necessary role bindings within the allowed namespaces. This would allow the application to access the required resources without needing cluster-wide permissions.

4. Consult with your Kubernetes administrator: Since policies can vary greatly between different Kubernetes environments, it's a good idea to consult with your Kubernetes administrator or the team responsible for cluster governance. They might have specific guidelines or alternative solutions that are compliant with your environment's policies.

Unfortunately, without the ability to create ClusterRoles, you will likely need to modify the application code or configuration to work within the constraints of your environment. If you're not familiar with the Kubernetes Client library, you may need assistance from someone who has experience with it to implement the necessary changes.

Please note that any modifications to the application code or configuration should be thoroughly tested to ensure that they do not introduce any new issues or security vulnerabilities.

This comment was generated by Glime.

[github-actions[bot]]

This discussion has been automatically closed due to inactivity. See our contributing guidelines for more details.

[github-actions[bot]]

This discussion has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns. See our contributing guidelines for more details.