Skip to content

fix: kubernetes exectutor health check uses out-of-scope command#18

Merged
Danelegend merged 3 commits intomainfrom
kube_rbac
Feb 28, 2026
Merged

fix: kubernetes exectutor health check uses out-of-scope command#18
Danelegend merged 3 commits intomainfrom
kube_rbac

Conversation

@Danelegend
Copy link
Contributor

Currently the health check of the kubernetes executor uses read_namespace. This uses additional rbac permissions. We want to limit the amount of permissions. This change uses the create verb to check if we have access to that resource (which we need to create sub-pods).

*   Trying 127.0.0.1:8000...
* Connected to 127.0.0.1 (127.0.0.1) port 8000
> GET /health HTTP/1.1
> Host: 127.0.0.1:8000
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 OK
< date: Fri, 27 Feb 2026 18:49:40 GMT
< server: uvicorn
< content-length: 79
< content-type: application/json
< 
* Connection #0 to host 127.0.0.1 left intact
{"status":"error","message":"Kubernetes API error (namespace=onyx): Forbidden"}%    

@Danelegend Danelegend merged commit bbe245c into main Feb 28, 2026
3 checks passed
@Danelegend Danelegend deleted the kube_rbac branch February 28, 2026 00:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants