[deckhouse-cli] Fix the ClusterRole and cache timing in RPP docs - #443
Draft
Glitchy-Sheep wants to merge 2 commits into
Draft
[deckhouse-cli] Fix the ClusterRole and cache timing in RPP docs#443Glitchy-Sheep wants to merge 2 commits into
Glitchy-Sheep wants to merge 2 commits into
Conversation
- Plugins need `cli-download`, not `packages-download`: they live under `deckhouse-cli/plugins/<name>` and travel the same `/v1/images/` route as self-update. - The proxy caches a denial for 30 seconds, so a `403` clears by itself. A fresh token does nothing. - Endpoint discovery reads the `registry-packages-proxy` Ingress, so an identity also needs `get` on it. - Point both docs at the module page for the grant commands, and fix the download route to `/images/<version>`. Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
Glitchy-Sheep
force-pushed
the
fix/rpp-endpoint-candidates
branch
from
August 12, 2026 08:32
b85e3a6 to
4f41578
Compare
Glitchy-Sheep
changed the title
- New "Getting started" section in `self-update.md`: ask for access, get a kubeconfig, check it, use it. - It links to the module page for the grant commands, so a user knows what to ask the administrator for. - `plugins.md` points at the same walkthrough: one kubeconfig and one grant cover both. Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The docs told admins to bind the wrong ClusterRole for plugins, and told users to wait five minutes for something that clears in thirty seconds. Both claims were checked against the code and fixed.
Problem
plugins.mdsaid plugin downloads needd8:registry-packages-proxy:packages-download, and that it differs from self-update'scli-download. Wrong on both counts. Plugins are published underdeckhouse-cli/plugins/<name>and travel the same/v1/images/route, which the proxy guards with thecli-binarysubresource. An admin following these docs bound a role that grants nothing, and downloads kept returning403.403clears by itself in half a minute, and a new token changes nothing.registry-packages-proxyIngress. A narrower identity without that permission fails before it ever reaches the proxy.internal/selfupdate/README.mdlisted the download route as/v1/images/deckhouse-cli/tags/<tag>. The proxy does not serve that path.Fix
cli-downloadcoversd8 cliandd8 plugins./v1/images/deckhouse-cli/images/<version>?platform=<os>-<arch>.Before / After
Before: an admin bound
packages-download, plugins still returned403, and the docs blamed a five-minute cache.After: the docs name the one role that works, the one extra permission discovery needs, and the real 30-second retry window.
Notes
Depends on deckhouse#21933, which adds the "Granting access to CLI downloads" section both pages link to.