Skip to content

Conversation

@pinheadmz
Copy link
Contributor

@pinheadmz pinheadmz commented Feb 12, 2025

Closes #680

Usage:

If you are the admin of a wargames battle you can, for example, run the faucet scenario as an admin. this gives your commander pod a ClusterRole which enables it to access all pods and all namespaces, which is necessary to get receive addresses from all armada nodes.

warnet run --source_dir=scenarios/ scenarios/admin/faucet.py --debug --admin

If an admin runs this scenario WITHOUT the admin flag, they won't get an error from kubernetes but the scenario will fail to collect receive addresses from armada tanks, and thus will try to split up the goods among ZERO recipients:

Traceback (most recent call last):
  File "/shared/archive.pyz/test_framework/test_framework.py", line 131, in main
    self.run_test()
  File "/shared/archive.pyz/admin/faucet.py", line 59, in run_test
    bal_amt = bal_sats // len(self.addrs)
              ~~~~~~~~~^^~~~~~~~~~~~~~~~~
ZeroDivisionError: integer division or modulo by zero

If a wargames user with a namespace-restricted user account tries to run a scenario with --admin they will get an error:


Failed to deploy scenario commander: faucet
Error: Error: Unable to continue with install: could not get information about the resource ClusterRole "commander-faucet-1739390548" in namespace "": clusterroles.rbac.authorization.k8s.io
"commander-faucet-1739390548" is forbidden: User "system:serviceaccount:wargames-rust:warnet-user" cannot get resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope

This should not affect wargames users running their own scenarios normally.

TODO

@pinheadmz pinheadmz changed the title scenarios: add --admin flag to run command for ClusterRole access scenarios: add --admin flag to run command for ClusterRole access Feb 12, 2025
@pinheadmz pinheadmz marked this pull request as ready for review February 13, 2025 17:04
@pinheadmz pinheadmz merged commit 7f648db into main Feb 13, 2025
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

is it possible to deploy scenarios as an admin with access to all namespaces?

2 participants