[BUG] Do we miss create for ClusterRole yurt-tunnel-server ?

[adamzhoul]

What happened:

E0923 13:40:03.970458       1 certificate_manager.go:434] Failed while requesting a signed certificate from the master: cannot create certificate signing request: certificatesigningrequests.certificates.k8s.io is forbidden: User "system:serviceaccount:kube-system:yurt-tunnel-server" cannot create resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope

Anything else we need to know?:

openyurt/cmd/yurt-tunnel-server/app/start.go

Lines 105 to 114 in 07c3409

	// 2. create a certificate manager for the tunnel server and run the
	// csr approver for both yurttunnel-server and yurttunnel-agent
	serverCertMgr, err := certmanager.NewYurttunnelServerCertManager(cfg.Client, cfg.CertDNSNames, cfg.CertIPs, stopCh)
	if err != nil {
	return err
	}
	serverCertMgr.Start()
	go certmanager.NewCSRApprover(cfg.Client, cfg.SharedInformerFactory.Certificates().V1beta1().CertificateSigningRequests()).
	Run(constants.YurttunnelCSRApproverThreadiness, stopCh)

openyurt/pkg/yurtctl/constants/yurt-tunnel-server-tmpl.go

Lines 20 to 36 in 07c3409

	YurttunnelServerClusterRole = `
	apiVersion: rbac.authorization.k8s.io/v1
	kind: ClusterRole
	metadata:
	annotations:
	rbac.authorization.kubernetes.io/autoupdate: "true"
	name: yurt-tunnel-server
	rules:
	- apiGroups:
	- certificates.k8s.io
	resources:
	- certificatesigningrequests
	verbs:
	- get
	- list
	- watch
	- apiGroups:

/kind bug

[rambohe-ch]

@adamzhoul you are right. we need to add create right for yurt-tunnel-server clusterrole.

btw: we delete create right careless in this commit: 86d19ca

[rambohe-ch]

@adamzhoul Would you like to make a pull request to add create right for yurt-tunnel-server?

[adamzhoul]

sure