kapp deploy fails with when not allowed to list cluster pods

[eLco]

When running kapp deploy with namespace-scoped RBAC user, with flag --logs-all, getting error:

Pod watching error: pods is forbidden: User "deploy-manager" cannot list resource "pods" in API group "" at the cluster scope

Seems like the similar issue - #34

[cppforlife]

@eLco will take a look how to better deal with that.

[gretel]

i'm also getting this:

...
Namespace  Name              Kind  Conds.  Age  Op      Wait to    Rs  Ri
some-ca    some-job  Job   1/1 t   1m   update  reconcile  ok  Completed

Op:      0 create, 0 delete, 1 update, 0 noop
Wait to: 1 reconcile, 0 delete, 0 noop
Pod watching error: pods is forbidden: User "devop.zombie@enterprise.com" cannot list resource "pods" in API group "" at the cluster scope

12:20:24PM: ---- applying 1 changes [0/1 done] ----

[cppforlife]

here is related piece of code: https://github.com/k14s/kapp/blob/918c7d3f80422031170a3521a9b9e95ff19e8f23/pkg/kapp/resources/identified_resources_pods.go#L32 that does cluster-scoped find. would probably have to add fallback to search within possible namespaces.

[gretel]

@cppforlife ya, cluster-scope is forbidden, can only enumerate single namespace.