fix(backend): Backend - Cache - Fixed reinstallation. Fixes kubeflow#…

…4299 (kubeflow#4320)

* Backend - Cache - Fixed reinstallation by adding missing roles

* Stop ignoring the deletion errors

* Added patch permission as well

It should not be triggered, but might be useful in the future.

backend/src/cache/deployer/deploy-cache-service.sh

@@ -28,7 +28,7 @@ WEBHOOK_SECRET_NAME=webhook-server-tls
 
 # This should fail if there are connectivity problems
 # Gotcha: Listing all objects requires list permission,
-# but when listing a single oblect kubecttl will fail if it's not found
+# but when listing a single oblect kubectl will fail if it's not found
 # unless --ignore-not-found is specified.
 kubectl get mutatingwebhookconfigurations "${MUTATING_WEBHOOK_CONFIGURATION_NAME}" --namespace "${NAMESPACE}" --ignore-not-found >webhooks.txt
 kubectl get secrets "${WEBHOOK_SECRET_NAME}" --namespace "${NAMESPACE}" --ignore-not-found >cache_secret.txt
@@ -50,12 +50,12 @@ fi
 
 if [ "$webhook_config_exists" == "true" ]; then
     echo "Warning: Webhook config exists, but the secret does not exist. Reinstalling."
-    kubectl delete mutatingwebhookconfigurations "${MUTATING_WEBHOOK_CONFIGURATION_NAME}" --namespace "${NAMESPACE}" || true
+    kubectl delete mutatingwebhookconfigurations "${MUTATING_WEBHOOK_CONFIGURATION_NAME}" --namespace "${NAMESPACE}"
 fi
 
 if [ "$webhook_secret_exists" == "true" ]; then
     echo "Warning: Webhook secret exists, but the config does not exist. Reinstalling."
-    kubectl delete secrets "${WEBHOOK_SECRET_NAME}" --namespace "${NAMESPACE}" || true
+    kubectl delete secrets "${WEBHOOK_SECRET_NAME}" --namespace "${NAMESPACE}"
 fi
 
 

manifests/gcp_marketplace/chart/kubeflow-pipelines/templates/cache.yaml

@@ -36,7 +36,10 @@ rules:
   - mutatingwebhookconfigurations
   verbs:
   - create
+  - delete
   - get
+  - list
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -52,8 +55,10 @@ rules:
   - secrets
   verbs:
   - create
+  - delete
   - get
   - patch
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

manifests/kustomize/base/cache-deployer/cache-deployer-role.yaml

@@ -11,5 +11,7 @@ rules:
   - secrets
   verbs:
   - create
+  - delete
   - get
   - patch
+  - list

manifests/kustomize/base/cache-deployer/cluster-scoped/cache-deployer-clusterrole.yaml

@@ -21,4 +21,7 @@ rules:
   - mutatingwebhookconfigurations
   verbs:
   - create
+  - delete
   - get
+  - list
+  - patch