From 68482f2d3dbbe532d58ccb0f8fa9081219de61f4 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Tue, 5 May 2026 18:18:24 +0200 Subject: [PATCH] home-assistant: split Role for InfluxDB-token Secret RBAC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Token Job hit `secrets is forbidden: ... cannot create resource` even though the Role listed `create` in verbs. Kubernetes RBAC rejects `create` verbs combined with `resourceNames` — at creation time the resource doesn't yet exist by name, so the rule never matches. Standard pattern: split into two rules — blanket `create` on Secrets in the namespace (creating any other Secret is the only collateral damage, and there's no other actor with this SA), plus resourceNames- restricted `get/update/patch` on the single named `ha-influxdb-token` Secret. Job now creates on first run and updates in place on later runs. --- kubernetes/seed/influxdb/ha-token-job.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/kubernetes/seed/influxdb/ha-token-job.yaml b/kubernetes/seed/influxdb/ha-token-job.yaml index 3528ecbb..8e41b378 100644 --- a/kubernetes/seed/influxdb/ha-token-job.yaml +++ b/kubernetes/seed/influxdb/ha-token-job.yaml @@ -29,10 +29,17 @@ metadata: name: ha-influxdb-token-writer namespace: home-assistant rules: + # `create` cannot be combined with resourceNames — the resource + # doesn't exist yet at creation time. Split into two rules: blanket + # `create` on Secrets in the namespace, then resourceNames-restricted + # `get/update/patch` on the single token Secret. + - apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] - apiGroups: [""] resources: ["secrets"] resourceNames: ["ha-influxdb-token"] - verbs: ["get", "create", "update", "patch"] + verbs: ["get", "update", "patch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding