fix(ci-diagnostics): grant read on velero.io and postgresql.cnpg.io CRDs #254

2026-07-16T08:36:11Z

claude-bot commented

2026-07-16 08:36:11 +00:00

Found on the first real use of the restricted identity (verifying #253 post-merge): assessing the VeleroBackupFailed issue #251 requires reading backups.velero.io — the latest apps-daily backup is PartiallyFailed (data-mover pod unschedulable, unbound PVC) even though the alert itself cleared — and the ClusterRole had neither velero.io nor postgresql.cnpg.io.

Also documents the name-collision gotcha for agents: bare get backup in the velero namespace resolves to CNPG's backups first; use backups.velero.io.

Everything else from #253 verified working with the restricted identity: pods/logs/sts/externalsecrets/proxy APIs readable, secrets 403, all writes denied (auth can-i "" "" → no).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei

Found on the first real use of the restricted identity (verifying #253 post-merge): assessing the VeleroBackupFailed issue #251 requires reading backups.velero.io — the latest apps-daily backup is PartiallyFailed (data-mover pod unschedulable, unbound PVC) even though the alert itself cleared — and the ClusterRole had neither velero.io nor postgresql.cnpg.io. Also documents the name-collision gotcha for agents: bare `get backup` in the velero namespace resolves to CNPG's backups first; use `backups.velero.io`. Everything else from #253 verified working with the restricted identity: pods/logs/sts/externalsecrets/proxy APIs readable, secrets 403, all writes denied (auth can-i \"*\" \"*\" → no). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei

claude-bot added 1 commit 2026-07-16 08:36:11 +00:00

fix(ci-diagnostics): grant read on velero.io and postgresql.cnpg.io CRDs 3e9e414018

Found on the first real use of the restricted identity: assessing the
VeleroBackupFailed issue (#251) needs backups.velero.io (latest
apps-daily run is PartiallyFailed — data-mover pod unschedulable on an
unbound PVC), and the ClusterRole had neither velero.io nor CNPG.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei

k.renner merged commit e298df0129 into master

2026-07-16 08:37:48 +00:00

k.renner referenced this issue from a commit

2026-07-16 08:37:49 +00:00

Merge pull request 'fix(ci-diagnostics): grant read on velero.io and postgresql.cnpg.io CRDs' (#254) from fix/diag-rbac-velero-cnpg into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#254