Flux CD
Medium
Security
After an upgrade to Flux 2.10, OCIRepositories with provider: aws and a spec.serviceAccountName stop getting credentials. What is missing?
Select your answer:
Show answer and explanation
Answer: RBAC that lets source-controller create serviceaccounts/token
Explanation
Object identity asks the TokenRequest API for a token for the named ServiceAccount, which needs create on serviceaccounts/token. Flux 2.10 removed that verb from its default RBAC, so you bind a ClusterRole granting it before upgrading. The ObjectLevelWorkloadIdentity gate is retired in 2.10 because the feature is always on.
More medium Flux CD questions
- In Flux 2.10, what happens to spec.summary when a v1beta3 Alert is converted to notification.toolkit.fluxcd.io/v1?
- In Flux 2.10, how can a HelmRelease install an OCI chart without a separately declared source object?
- A Kustomization must only be applied after another Kustomization that installs CRDs is ready. Which field do you set?
- What does spec.wait: true do on a Flux Kustomization?
- How do you substitute a per-cluster value such as ${cluster_region} into the manifests a Flux Kustomization applies?
- How does Flux decrypt Secrets that are stored encrypted with SOPS in Git?