This message was deleted.

# Default values for cerbos. # This is a YAML-formatted file. # Declare variables to be passed into your templates. nameOverride: "cerbos" fullnameOverride: "cerbos" # Number of Cerbos pods to run replicaCount: 6 # Container image details image: repository: ghcr.io/cerbos/cerbos pullPolicy: IfNotPresent # Image tag to use. Defaults to the chart appVersion. tag: "" imagePullSecrets: [] serviceAccount: # Specifies whether a service account should be created create: true # Annotations to add to the service account annotations: {} # The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" # Annotations to add to the pod. podAnnotations: {} # Security context for the whole pod. podSecurityContext: {} # fsGroup: 2000 # Security context for the Cerbos container. securityContext: {} # capabilities: # drop: # - ALL # readOnlyRootFilesystem: true # runAsNonRoot: true # runAsUser: 1000 # Resource limits for the pod. resources: {} # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # Autoscaling configuration. autoscaling: enabled: false minReplicas: 1 maxReplicas: 100 targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 # Node selector for the pod. nodeSelector: {} # Pod tolerations. tolerations: [] # Pod affinity rules. affinity: {} # Volumes to add to the pod. volumes: [] # Volume mounts to add to the Cerbos container. volumeMounts: [] # Environment variables to add to the pod. env: [] # Source environment variables from config maps or secrets. envFrom: [] # Cerbos service settings. service: type: ClusterIP httpPort: 3592 grpcPort: 3593 # Cerbos deployment settings. cerbos: # Port to expose the http service on. httpPort: 3592 # Port to expose the gRPC service on. grpcPort: 3593 # Secret containing the TLS certificate. # Leave empty to disable TLS. # The secret must contain the following keys: # - tls.crt: Required. Certificate file contents. # - tls.key: Required. Private key for the certificate. # - ca.crt: Optional. CA certificate to add to the trust pool. tlsSecretName: "controlshift.io" # Cerbos log level. Valid values are DEBUG, INFO, WARN and ERROR logLevel: INFO # Add Prometheus service discovery annotations to the pod. prometheusPodAnnotationsEnabled: true # Cerbos config file contents. # Some server settings like server.httpListenAddr, server.grpcListenAddr, server.tls will be overwritten by the chart based on values provided above. config: engine: defaultPolicyVersion: "default" storage: driver: "blob" blob: bucket: "gs://<redacted>" workDir: ${HOME}/tmp/cerbos/work updatePollInterval: 10s server: adminAPI: enabled: true adminCredentials: username: <redacted> passwordHash: <redacted> auxData: jwt: disableVerification: true

Probably. What’s the full error message?

message has been deleted

Yes, looks like a permission problem

hmmmm okay

It reads that from environment, but I don’t know if K8s service account running in GKE implies credentials of GCP service account.

i have already assigned storage viewer role to the default GKE compute service account

Is it possible to spin up a pod with GCP CLI, assign the same permissions to the pod and try to download files from the bucket?

I have to install the gcs cli tool called gsutil inside it. Let me see how I cna do that.

Can you list files?

oh....just run the binary? what about the configuration that the binary will use?

yes

that link only tells me to download and extract the gzipped tarball

You have your

values.yml

file you use with Helm

ok

Has it downloaded files?

well my bucket is empty

It looks for

*.yml,**.yaml,**.json

files

ok let me create a dummy yaml file. it doesn't validate the content of the yaml for download?

it will blow up, since it will try to interpret it as a policy

yes so this is what i have done. i placed a yaml file inside...it's a rubbish yaml

looks good

which is expected

yes

alright. much obliged. you've been very helpful.

no problem

Ok

It is k8s best practice to have dedicated service accounts for applications. That's why the Helm chart creates a Kubernetes service account (not GCP service account) by default for Cerbos. It has no cluster privileges because Cerbos doesn't need any.

Alright let me try that.

Seems OK on the surface. I would not use environment variables in the path though. They can be interpreted differently. Use an absolute path like

/secret

Is it in the same namespace?

Yes. The name space is cerbos.

You are mounting the certs volume through Helm values as well, right?

Oh wait!!!

Ah that would be why 🙂

Hahahaha a. Thanks

You're welcome