Permission issues when deploying sample provider from cluster-api book

[pablochacin]

/kind bug

Hi I'm following the guide for creating a new cluster-api provider, and I'm getting the following error in the controller's log:

$> kubectl logs cluster-api-provider-solas-controller-manager-0 --namespace cluster-api-provider-solas-system -c manager
W0211 21:48:48.731633       1 controller.go:57] environment variable NODE_NAME is not set, this controller will not protect against deleting its own machine
{"level":"info","ts":1549921728.7322876,"logger":"kubebuilder.controller","msg":"Starting EventSource","controller":"machine-controller","source":"kind source: /, Kind="}
{"level":"info","ts":1549921728.7324562,"logger":"kubebuilder.controller","msg":"Starting EventSource","controller":"cluster-controller","source":"kind source: /, Kind="}
E0211 21:48:48.734469       1 reflector.go:134] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:126: Failed to list *v1alpha1.Machine: machines.cluster.k8s.io is forbidden: User "system:serviceaccount:cluster-api-provider-solas-system:default" cannot list resource "machines" in API group "cluster.k8s.io" at the cluster scope
E0211 21:48:48.734525       1 reflector.go:134] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:126: Failed to list *v1alpha1.Cluster: clusters.cluster.k8s.io is forbidden: User 

I suppose it has to do with the permissions set in `config/rbac_role.yaml'

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: manager-role
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:

Environment:

• Cluster-api version: 0.0.0-alpha.4
• Kubernetes version: (use kubectl version): v1.13.2
• OS (e.g. from /etc/os-release): OpenSUSE Leap 15.0

[pablochacin]

The solution to this issue is to add a patch for the ClusterRole defined in rbac_role.yaml, adding the missing rules, so that this is updated when generating the manifest:

Create config/default/rbac_cluster_api_patch.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: manager-role
rules:
- apiGroups:
  - cluster.k8s.io
  resources:
  - clusters
  - clusters/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - cluster.k8s.io
  resources:
  - machines
  - machines/status
  - machinedeployments
  - machinedeployments/status
  - machinesets
  - machinesets/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete

modify config/default/kustomization.yaml adding the following entry to patches

patches:
- rbac_cluster_api_patch.yaml

[pablochacin]

/assign @pablochacin

[pablochacin]

I'm willing to fix this issue but need some help to know where in the documentation this new instructions should added.

/help

[k8s-ci-robot]

@pablochacin:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

I'm willing to fix this issue but need some help to know where in the documentation this new instructions should added.

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[vincepri]

/cc @davidewatson
/milestone v1alpha1

[detiber]

/assign @davidewatson
/priority important-soon