I am attempting to get an
Upgrade a Helm Chart step working. I set it up and it is very close. But I am seeing this in log output:
Creating kubectl context to https://myKubeCluster:443 (namespace default) using a Token User "octouser" set. Error from server (Forbidden): namespaces is forbidden: User "myLimitedUser@mydomain.com" cannot create resource "namespaces" in API group "" at the cluster scope Invoking target script "/etc/octopus/Work/20210428024226-122445-125/staging/Calamari.HelmUpgrade.sh" with parameters Release "my-kube-release-name-here" does not exist. Installing it now.
The key line in here is the third one. (The error attempting to create a namespace.) I have setup my user that runs deployments to not have permissions to create namespaces to restrict damage it can cause. So I see why any attempt to create a namespace would fail.
But I am confused as to what is causing this to happen as my Helm chart does not create a namespace.
It seems that this is a action that Octopus Deploy is taking on its own. I arrive at this conclusion because of the following:
The error log message precedes the line saying that it is going to invoke the script that runs the Helm Chart. (And the line saying that it is going to create the release).
When I login as my reduced permissions user and manually run the helm chart (using the same command as is output in the logs), it runs without issues. (No namespace related errors.)
So it seems that the failure to create the namespace is before the helm chart update is started. But I am confused as to why Octopus would need to create a namespace in order to run the upgrade step. (The only step in my deployment is the one Upgrade Helm Chart step.)
What is going on and how can I get around this error?