Add deployments permission to role and clusterrole

[bstadlbauer]

This should fix #749

@jacobtomlinson I've tested this on a fresh k8s cluster where I've helm-installed the operator.

The deployment for the scheduler has been created after I've added the permissions, however, once the scheduler started running I've seen the following exception:

[2023-06-28 09:51:39,162] kopf.objects         [ERROR   ] [dask-ns/my-dask-cluster-scheduler] Handler 'handle_scheduler_service_status/status' failed with an exception. Will retry.
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/kopf/_core/actions/execution.py", line 276, in execute_handler_once
    result = await invoke_handler(
  File "/usr/local/lib/python3.10/site-packages/kopf/_core/actions/execution.py", line 371, in invoke_handler
    result = await invocation.invoke(
  File "/usr/local/lib/python3.10/site-packages/kopf/_core/actions/invocation.py", line 116, in invoke
    result = await fn(**kwargs)  # type: ignore
  File "/usr/local/lib/python3.10/site-packages/dask_kubernetes/operator/controller/controller.py", line 371, in handle_scheduler_service_status
    cluster = await DaskCluster.get(
  File "/usr/local/lib/python3.10/site-packages/kr8s/_objects.py", line 137, in get
    api = await kr8s.asyncio.api()
  File "/usr/local/lib/python3.10/site-packages/kr8s/asyncio/_api.py", line 31, in api
    return await _f(
  File "/usr/local/lib/python3.10/site-packages/kr8s/asyncio/_api.py", line 29, in _f
    return await _cls(**kwargs, bypass_factory=True)
  File "/usr/local/lib/python3.10/site-packages/kr8s/_api.py", line 53, in f
    await self.auth
  File "/usr/local/lib/python3.10/site-packages/kr8s/_auth.py", line 44, in f
    await self.reauthenticate()
  File "/usr/local/lib/python3.10/site-packages/kr8s/_auth.py", line 56, in reauthenticate
    raise ValueError("Unable to find valid credentials")

Not sure whether this is related

Closes #749

[jacobtomlinson]

Thanks for picking this up @bstadlbauer. The error you shared looks incomplete, is there any more to it?

That error suggests that kr8s can't find the service account credentials in the deployment. Let me look into that.

[bstadlbauer]

@jacobtomlinson Sorry, the copying out of Lens didn't work 🤦

Updated the comment above, but here it is again:

[2023-06-28 09:51:39,162] kopf.objects         [ERROR   ] [dask-ns/my-dask-cluster-scheduler] Handler 'handle_scheduler_service_status/status' failed with an exception. Will retry.
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/kopf/_core/actions/execution.py", line 276, in execute_handler_once
    result = await invoke_handler(
  File "/usr/local/lib/python3.10/site-packages/kopf/_core/actions/execution.py", line 371, in invoke_handler
    result = await invocation.invoke(
  File "/usr/local/lib/python3.10/site-packages/kopf/_core/actions/invocation.py", line 116, in invoke
    result = await fn(**kwargs)  # type: ignore
  File "/usr/local/lib/python3.10/site-packages/dask_kubernetes/operator/controller/controller.py", line 371, in handle_scheduler_service_status
    cluster = await DaskCluster.get(
  File "/usr/local/lib/python3.10/site-packages/kr8s/_objects.py", line 137, in get
    api = await kr8s.asyncio.api()
  File "/usr/local/lib/python3.10/site-packages/kr8s/asyncio/_api.py", line 31, in api
    return await _f(
  File "/usr/local/lib/python3.10/site-packages/kr8s/asyncio/_api.py", line 29, in _f
    return await _cls(**kwargs, bypass_factory=True)
  File "/usr/local/lib/python3.10/site-packages/kr8s/_api.py", line 53, in f
    await self.auth
  File "/usr/local/lib/python3.10/site-packages/kr8s/_auth.py", line 44, in f
    await self.reauthenticate()
  File "/usr/local/lib/python3.10/site-packages/kr8s/_auth.py", line 56, in reauthenticate
    raise ValueError("Unable to find valid credentials")

Running on a docker_desktop k8s cluster (the one that comes with Docker for Mac)

[jacobtomlinson]

I think that error is unrelated to the deployment permissions. Let's open a separate issue to track that and merge this in. Do you mind opening it?

[Artimi]

I've created a new issue for the Unable to find valid credentials #751 before I saw this conversation. I too believe it is independent to missing Deployment permissions.

Thanks for the quick fix of the deployment issue.