Add preinstall checks for deletion and creation of secrets
@@ -442,6 +442,20 @@ func (hc *HealthChecker) allCategories() []category {
return hc.checkCanCreate(hc.ControlPlaneNamespace, "", "v1", "configmaps")
},
},
+ {
+ description: "can create Secrets",
+ hintAnchor: "pre-k8s",
+ check: func(context.Context) error {
+ return hc.checkCanCreate(hc.ControlPlaneNamespace, "", "v1", "secrets")
+ },
+ },
+ {
+ description: "can read Secrets",
+ hintAnchor: "pre-k8s",
+ check: func(context.Context) error {
+ return hc.checkCanGet(hc.ControlPlaneNamespace, "", "v1", "secrets")
+ },
+ },
{
description: "no clock skew detected",
hintAnchor: "pre-k8s-clock-skew",
@@ -1331,7 +1345,7 @@ func (hc *HealthChecker) getDataPlanePods(ctx context.Context) ([]*pb.Pod, error
return pods, nil
}
-func (hc *HealthChecker) checkCanCreate(namespace, group, version, resource string) error {
+func (hc *HealthChecker) checkCanPerformAction(verb, namespace, group, version, resource string) error {
if hc.kubeAPI == nil {
// we should never get here
return fmt.Errorf("unexpected error: Kubernetes ClientSet not initialized")
@@ -1340,7 +1354,7 @@ func (hc *HealthChecker) checkCanCreate(namespace, group, version, resource stri
return k8s.ResourceAuthz(
hc.kubeAPI,
namespace,
- "create",
+ verb,
group,
version,
resource,
@@ -1348,6 +1362,14 @@ func (hc *HealthChecker) checkCanCreate(namespace, group, version, resource stri
)
}
+func (hc *HealthChecker) checkCanCreate(namespace, group, version, resource string) error {
+ return hc.checkCanPerformAction("create", namespace, group, version, resource)
+}
+
+func (hc *HealthChecker) checkCanGet(namespace, group, version, resource string) error {
+ return hc.checkCanPerformAction("get", namespace, group, version, resource)
+}
+
func (hc *HealthChecker) checkCapability(cap string) error {
if hc.kubeAPI == nil {
// we should never get here
