wrecks-wl7una has three tickets that never touch the application. Read them:
sh
kubectl get pods,deploy -n wrecks-wl7una
kubectl describe pod -l app=market-api -n wrecks-wl7una | grep Warning
kubectl get cm market-config -n wrecks-wl7una -o yaml
kubectl describe rs -l app=market-web -n wrecks-wl7una | tail -2
kubectl auth can-i list pods -n wrecks-wl7una --as=system:serviceaccount:wrecks-wl7una:deployerFix each on the config side: the key the API asks for, the ServiceAccount the web template names, and a Role plus RoleBinding that lets deployer list Pods in this namespace.
sh
kubectl create sa web-runner -n wrecks-wl7una
kubectl create role pod-reader --verb=list,get --resource=pods -n wrecks-wl7una
kubectl create rolebinding deployer-pod-reader --role=pod-reader --serviceaccount=wrecks-wl7una:deployer -n wrecks-wl7una