client.Get() requires watch permission

[kapilpau]

When trying to call client.Get(), if you don't have watch permissions for the resource, you get the following error, example get StorageClass:

pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:105: Failed to watch *v1.StorageClass: unknown (get storageclasses.storage.k8s.io)

Why does get require watch permission? It shouldn't be watching any resources

[dvob]

How does your code look like?

[camilamacedo86]

I understand that because of the cache the WACTH permission/verb is required.

[coderanger]

This is indeed normal and expected. If you want to make an uncached request, you can make a new client object instead.

[kapilpau]

@coderanger can we do that from the existing client?

[dvob]

I think you get this error already during startup and not really on the client.Get() call. If you create a controller for certain resources, it is normal that the controller manager starts to watch and list all resources that it can start the reconciliation if a resource changes (create/update/delete).
If you don't have a controller for that resource (which means no watch) you should be able to run client.Get() without watch permission.

[dvob]

Ok, I am probably wrong. If I understood #1222 correctly it seems that if you use Get or List on a resource for the first time it automatically gets added to the the informers which means it starts to watch that resource.

[kapilpau]

How can we prevent this? We want to be able to get an object by name without having watch permissions but currently cannot do that

[coderanger]

Use a non-caching client. Right now you, somewhere, have some code like Client: mgr.GetClient(). Change that to more like Client: client.New(mgr.GetConfig(), client.Options{Scheme: mgr.GetScheme(), Mapper: mgr.GetRESTMapper()}). That will give you a non-cached client. Just keep in mind that means you lose the benefits of caching. And of course you need watch permissions on anything in a For() or Owns() watch request.

[kapilpau]

Ok, thank you

[coderanger]

/close

[k8s-ci-robot]

@coderanger: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.