Skip to content

[manila-csi-plugin] drop rules from aggregated ClusterRoles for Helm 4 SSA - #3219

Closed
locker95 wants to merge 1 commit into
kubernetes:masterfrom
locker95:fix/manila-aggregated-clusterrole-ssa
Closed

locker95 wants to merge 1 commit into
kubernetes:masterfrom
locker95:fix/manila-aggregated-clusterrole-ssa

Conversation

@locker95

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

Helm 4 applies with server-side apply. The manila chart's aggregated controller/node ClusterRoles set rules: [], so Helm takes ownership of .rules. After install, clusterrole-aggregation-controller fills that field, and the next helm upgrade dies with a conflict on .rules.

Drop rules from those two templates. The aggregator still writes the real rules; Helm just stops claiming the field.

Which issue this PR fixes:

fixes #3119

Special notes for reviewers:

helm lint is clean. helm template no longer emits rules on the aggregated ClusterRoles. Static manifests are unchanged.

Release note:

[manila-csi-plugin] Helm chart aggregated ClusterRoles no longer set rules: [], so Helm 4 upgrades do not conflict with clusterrole-aggregation-controller.

Helm 4 server-side apply claims .rules when the chart sets rules: [].
clusterrole-aggregation-controller already owns that field, so the next
upgrade conflicts. Leave rules unset and let the aggregator fill them in.

Signed-off-by: Dean Chen <862469039@qq.com>
@kubernetes-prow kubernetes-prow Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 11, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

Hi @locker95. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubernetes-prow kubernetes-prow Bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Sep 11, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kayrus for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow
kubernetes-prow Bot requested a review from kayrus September 11, 2026 20:31
@locker95

Copy link
Copy Markdown
Contributor Author

closing this. #3127 landed the same chart change (drop rules: [] on the aggregated manila ClusterRoles).

@locker95 locker95 closed this Sep 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[manila-csi-plugin] Helm v4 upgrade fails on aggregated ClusterRoles due to SSA conflict on .rules

1 participant