Executing "argo rollouts get rollouts" from pod gives error.

[ansilh]

Summary

Executing argo rollouts get rollouts from pod gives error.
The service account is binded to cluster role argo-rollouts

> kubectl argo rollouts get rollouts <app>

E0406 14:57:53.477680      29 reflector.go:138] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:167:  \
Failed to watch *v1.Pod: unknown (get pods)

Diagnostics

What version of Argo Rollouts are you running?

/ # kubectl   argo rollouts version
kubectl-argo-rollouts: v1.2.0+08cf10e
  BuildDate: 2022-03-22T00:25:11Z
  GitCommit: 08cf10e554fe99c24c8a37ad07fadd9318e4c8a1
  GitTreeState: clean
  GoVersion: go1.17.6
  Compiler: gc
  Platform: linux/amd64

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

[huikang]

Hi, @ansilh , looks like I couldn't reproduce the error; the results from the command looks good.

kubectl argo rollouts get rollouts rollouts-demo 

Name:            rollouts-demo
Namespace:       default
Status:          ✔ Healthy
Strategy:        Canary
  Step:          9/9
  SetWeight:     100
  ActualWeight:  100
Images:          argoproj/rollouts-demo:blue (stable)
Replicas:

Could you provide more details about how to reproduce? Thanks.

[ansilh]

Hi, @huikang , Thanks for your help so far.
You may use the below steps to reproduce the error.
The Job logs will show the reported error.

Regarding why we are doing this;
We are using the helm atomic option for auto rollback when there is a failure during chart install/upgrade.
Helm doesn't understand "Rollout" so it returns with deployed status even before the pods become healthy.
We are trying to use a helm post-hook job to check the rollout status to overcome this.

This works, but the error regarding the pod watch permission will cause unwanted noise and need to fix it properly to have a clean workflow.

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: swissarmy
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-rollouts
subjects:
- kind: ServiceAccount
  name: swissarmy
  namespace: default
roleRef:
  kind: ClusterRole
  name: argo-rollouts
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    helm.sh/hook: post-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  name: app-get-rollout
spec:
  template:
    metadata:
      labels:
        app: app-get-app
      name: pp-get-rollout
    spec:
      restartPolicy: OnFailure
      serviceAccountName: swissarmy
      containers:
        - name: rolloutcheck
          image: ansilh/swiss-armor-knife:v0.0.1
          command:
            - sh
            - "-c"
            - >
               /usr/bin/kubectl-1.21 argo rollouts get rollouts my-app  --no-color | awk '/^Status:/{print $3}' | grep Healthy