miki3421 opened a new pull request, #241: URL: https://github.com/apache/openserverless-task/pull/241
Fresh K3s installations currently require a separate manual RBAC apply before the Secret-authorized user provisioning API can create tenants and their routes. Add `ops cloud k3s rbac` and invoke it from `ops cloud k3s create` after cert-manager setup. Related to Michele's request: https://github.com/nuvolaris/projects/issues/447. Complements the Admin API implementation already merged into `0.9.0`: https://github.com/apache/openserverless-admin-api/pull/64. The task creates the `openserverless` namespace if absent and applies a bundled copy of the existing provisioning Role/RoleBinding. The manifest is byte-for-byte identical to `deploy/user-provisioning/rbac.yaml` in Apache Admin API `0.9.0`. It binds the dedicated role to `openserverless-wsku`; the service account can be created later by the OpenServerless installation. A separate CLI invocation after K3s installation picks up the newly generated kubeconfig. The task does not create or overwrite `openserverless-user-provisioning-token`. The provisioning token remains externally managed, and existing broader roles are unchanged. Command usage and installation behavior are documented in `cloud/k3s/docopts.md`. Validation: YAML parsing, exact manifest comparison against Apache Admin API `0.9.0`, task discovery, dry-runs of `rbac` and the full `create` task, and `git diff --check` passed. No cluster installation or live RBAC mutation was performed for this change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
