Missing RBAC on ater a new helm installation

[yogeek]

As explained in this Slack conversation, after installing litmus-chaos from the helm chart (helm install chaos litmuschaos/litmus --namespace=litmus --create-namespace), and checking that all pods are running, loging into the UI, and waiting for the agent to be ready but it never happens because the pod workflow-controller is failing with this error :

level=fatal msg="Failed to register watch for controller config map: configmaps \"workflow-controller-configmap\" is forbidden: User \"system:serviceaccount:litmus:argo\" cannot get resource \"configmaps\" in API group \"\" in the namespace \"litmus\"" 

And when I look at the chart in github, I do not see argo serviceaccount...

The logs of the worflow confirms a problem with RBAC :

2021/11/22 12:49:28 clusterrolebindings.rbac.authorization.k8s.io "argo-binding" is forbidden: user "system:serviceaccount:litmus:litmus-server-account" (groups=["system:serviceaccounts" "system:serviceaccounts:litmus" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:[""], Resources:["persistentvolumeclaims"], Verbs:["get"]}

------------------------------------------------------------------------------------------------------------------------------------------------------------------
2021/11/22 12:49:33 SOME MANIFESTS HAS NOT BEEN INSTALLED:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argo-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-cluster-role
subjects:
  - kind: ServiceAccount
    name: argo
    namespace: litmus

And after adding the missing part manually ("get" permission for "persistentvolume" to the clusterrole and creating argo-binding ClusterRoleBinding), all pods become running and I can start creating workflow successfully

[uditgaurav]

cc: @Jonsy13

[BledaiOld]

Are there any updates here? we also encountered a similar error - as if some part of the RBAC was missing

[Deepak1100]

+1

[sravanthnag]

ClusterRoleBinding missed from a working setup all of a sudden. As mentioned in @yogeek post, after re-applying the ClusterRoleBinding for argo, workflow controller started working again..

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argo-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-cluster-role
subjects:
  - kind: ServiceAccount
    name: argo
    namespace: litmus

[Jonsy13]

Hi @sravanthnag @Deepak1100 @Bledai Can we get some setup details like k8s version, ChaosCenter version as well as would like to know If it was fresh install or upgrade.

[neelanjan00]

Hi, were you able to resolve this issue?