+1

config/rbac/role.yaml

··· 10 10 - nodes 11 11 verbs: 12 12 - list 13 13 + - watch 13 14 - apiGroups: 14 15 - "" 15 16 resources:

+1 -1

internal/controller/spindleset_controller.go

··· 55 55 // +kubebuilder:rbac:groups=loom.j5t.io,resources=spindlesets/finalizers,verbs=update 56 56 // +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete 57 57 // +kubebuilder:rbac:groups=batch,resources=jobs/status,verbs=get 58 58 - // +kubebuilder:rbac:groups="",resources=nodes,verbs=list 58 58 + // +kubebuilder:rbac:groups="",resources=nodes,verbs=list;watch 59 59 // +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch 60 60 // +kubebuilder:rbac:groups="",resources=pods/log,verbs=get 61 61 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch

+10 -3

internal/jobbuilder/job_template.go

··· 375 375 script := "set -e\n" + strings.Join(config.CloneCommands, "\n") + "\necho \"Repository ready\"" 376 376 377 377 return corev1.Container{ 378 378 - Name: "clone-repo", 379 379 - Image: "alpine/git:latest", 380 380 - Command: []string{"/bin/sh", "-c"}, 378 378 + Name: "clone-repo", 379 379 + Image: "alpine/git:latest", 380 380 + Command: []string{"/bin/sh", "-c"}, 381 381 + WorkingDir: "/tangled/workspace", 382 382 + Env: []corev1.EnvVar{ 383 383 + { 384 384 + Name: "HOME", 385 385 + Value: "/tmp", 386 386 + }, 387 387 + }, 381 388 SecurityContext: &corev1.SecurityContext{ 382 389 AllowPrivilegeEscalation: &[]bool{false}[0], 383 390 RunAsNonRoot: &[]bool{true}[0],