windows-gmsa icon indicating copy to clipboard operation
windows-gmsa copied to clipboard

Published 20 hours ago • verified publisher icon kubernetes-sigs

Namespaced gMSA credential spec doesn't work

Open ionutbalutoiu opened this issue 3 years ago • 14 comments

Changing the gmsacredentialspecs.windows.k8s.io CRD scope from Cluster to Namespaced at: https://github.com/kubernetes-sigs/windows-gmsa/blob/9fa8e91dc398196a8ecb70966f20a3d7ee806358/admission-webhook/deploy/gmsa-crd.yml#L118

results in the admission webhook failing with:

time="2021-11-24T19:57:14Z" level=info msg="refusing to admit pod &Pod{...} with code 500: unable to retrieve the contents of cred spec ns1-gmsa: the server could not find the requested resource"

whenever a container is created using any gMSA credential spec, from any namespace.

Reverting the CRD scope to Cluster, everything is fine.

ionutbalutoiu avatar Nov 24 '21 20:11 ionutbalutoiu

We should support Namespaced scope for the gMSA credential spec resources.

Some customers with multiple gMSA configs will not allow the gMSA credential specs to be visible to all the namespaces.

ionutbalutoiu avatar Nov 24 '21 20:11 ionutbalutoiu

/assign

marosset avatar Feb 01 '22 20:02 marosset

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar May 02 '22 21:05 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot avatar Jun 01 '22 21:06 k8s-triage-robot

/remove-lifecycle rotten

marosset avatar Jun 01 '22 22:06 marosset

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Aug 30 '22 23:08 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot avatar Sep 30 '22 00:09 k8s-triage-robot

/remove-lifecycle rotten

jsturtevant avatar Sep 30 '22 02:09 jsturtevant

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Dec 29 '22 02:12 k8s-triage-robot

/remove-lifecycle stale

jsturtevant avatar Jan 03 '23 19:01 jsturtevant

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Apr 09 '23 22:04 k8s-triage-robot

/remove-lifecycle stale /lifecycle-freeze

jsturtevant avatar Apr 14 '23 17:04 jsturtevant

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jul 13 '23 17:07 k8s-triage-robot

/remove-lifecycle stale /lifecycle frozen

jsturtevant avatar Aug 23 '23 17:08 jsturtevant