Date: 2026-05-13
BodyLog build_and_deploy runs failed during the Kubernetes rollout step because the bodylog-ci service account attempted to apply k8s/01-rbac.yaml and grant Role/bodylog-runtime permissions it did not itself hold.
Blocked grants reported by Kubernetes:
events: get, list, watchpods/log: get, list, watchdeployments/scale: get, list, watch, patch, updateApplied the current BodyLog runtime RBAC manifest once using admin kubeconfig:
kubectl --kubeconfig=/etc/kubernetes/admin.conf apply -f /home/ax_julian/temp/bodylog-main-01-rbac.yaml
Result:
serviceaccount/bodylog unchangedrole.rbac.authorization.k8s.io/bodylog-runtime configuredrolebinding.rbac.authorization.k8s.io/bodylog-runtime unchangedThe BodyLog deploy workflow should stop applying RBAC manifests from the normal CI identity. Runtime and CI RBAC manifests should be handled through an admin/bootstrap path to avoid Kubernetes RBAC self-escalation failures.
After the admin apply, the live BodyLog workloads remained healthy:
deployment/bodylog: 1/1deployment/bodylog-postgres: 1/1The live BodyLog app image remained the last successful deployment at the time of investigation:
gitea.app.lan/bodylog/bodylog.dev:sha-6533ec9a1254