controller-manager can't access RemoteCluster due to namespaced role

[miedzinski]

Bug Report

What version of Kubernetes are you using?
v1.25.16

What version of Chaos Mesh are you using?
2.6.3

What did you do? / Minimal Reproducible Example
Updated from Helm chart with clusterScoped: false.

What did you expect to see?
Chaos Mesh should apply chaos.

What did you see instead?

E0514 11:32:40.444526       1 reflector.go:140] pkg/mod/k8s.io/client-go@v0.26.1/tools/cache/reflector.go:169: Failed to watch *v1alpha1.RemoteCluster: failed to list *v1alpha1.RemoteCluster: remoteclusters.chaos-mesh.org is forbidden: User "system:serviceaccount:chaos-mesh:chaos-controller-manager" cannot list resource "remoteclusters" in API group "chaos-mesh.org" at the cluster scope: RBAC: clusterrole.rbac.authorization.k8s.io "default-read" not found

Output of chaosctl

---

The cause is that Helm creates role binding chaos-controller-manager-target-namespace as namespaced RoleBinding, but RemoteCluster isn't namespaced (has scope: Cluster). As a fix we should always create ClusterRoleBinding here:

chaos-mesh/helm/chaos-mesh/templates/controller-manager-rbac.yaml

Lines 158 to 162 in 6411f53

	{{- if .Values.clusterScoped }}
	kind: ClusterRoleBinding
	{{- else }}
	kind: RoleBinding
	{{- end }}

[STRRL]

Hi @miedzinski , It's better to create another role and cluster role biding for the CRD RemoteCluster.

Could you help us to improve it?

[miedzinski]

You're right. There is a ClusterRole for that

chaos-mesh/helm/chaos-mesh/templates/controller-manager-rbac.yaml

Lines 70 to 91 in 6411f53

	kind: ClusterRole
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	name: {{ .Release.Name }}-chaos-controller-manager-cluster-level
	labels:
	{{- include "chaos-mesh.labels" . | nindent 4 }}
	app.kubernetes.io/component: controller-manager
	rules:
	- apiGroups: [ "" ]
	resources:
	- nodes
	- persistentvolumes
	- persistentvolumeclaims
	{{- if .Values.clusterScoped }}
	- namespaces
	- services
	{{- end }}
	verbs: [ "get", "list", "watch" ]
	- apiGroups: [ "authorization.k8s.io" ]
	resources:
	- subjectaccessreviews
	verbs: [ "create" ]

so it could be added there. Submitted #4419.