From 9014a170d7d7e40be6a0d1effaea3cf806e38505 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Tue, 8 Sep 2026 06:58:22 +0530 Subject: [PATCH] Add autoscaling/horizontalpodautoscalers to deployer's ClusterRole MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Companion change to toolshed's new multi-replica/autoscaling feature (internal/deploy.Client.ensureAutoscaler in the toolshed repo) — without this, deployer's own attempt to create a HorizontalPodAutoscaler for any app with autoscaling enabled fails with "forbidden" the first time someone actually uses the feature, exactly the failure mode internal/deploy/kubernetes.go's own package doc comment warns about for these two unsynchronized copies of deployer's permission list. Kept in sync with toolshed's own deploy/helm/toolshed/templates/rbac.yaml, which received the identical addition. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Wajog7nELA3i8JWTjxYGHF --- extra-manifests/toolshed-deployer-rbac.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/extra-manifests/toolshed-deployer-rbac.yaml b/extra-manifests/toolshed-deployer-rbac.yaml index b240275..8ee8ea2 100644 --- a/extra-manifests/toolshed-deployer-rbac.yaml +++ b/extra-manifests/toolshed-deployer-rbac.yaml @@ -61,6 +61,15 @@ rules: - apiGroups: ["networking.k8s.io"] resources: ["networkpolicies"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + # Created only for an app with autoscaling enabled (max replicas set + # above min); removed again if it's turned back off. See toolshed's own + # internal/deploy.Client.ensureAutoscaler. Added alongside that feature — + # keep this file and toolshed's deploy/helm/toolshed/templates/rbac.yaml + # in sync, per internal/deploy/kubernetes.go's own package doc warning + # that the two are unsynchronized copies in two repositories. + - apiGroups: ["autoscaling"] + resources: ["horizontalpodautoscalers"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding