Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add missing rbac rules for the newly created controllers #875

Merged
merged 1 commit into from
Oct 12, 2022

Conversation

panyuenlau
Copy link
Member

@panyuenlau panyuenlau commented Oct 12, 2022

Q A
Bug fix? yes
New feature? no
API breaks? no
Deprecations? no
License Apache 2.0

What's in this PR?

Add the missing RBAC to the koperator helm chart for the newly created controller for cruise control operations

Why?

The operator doesn't function as expected due to the missing RBAC when a user installs the operator via helm chart, for example:

W1012 19:19:04.011198       1 reflector.go:424] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
E1012 19:19:04.011232       1 reflector.go:140] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: Failed to watch *v1alpha1.CruiseControlOperation: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
W1012 19:19:06.996660       1 reflector.go:424] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
E1012 19:19:06.996689       1 reflector.go:140] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: Failed to watch *v1alpha1.CruiseControlOperation: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
W1012 19:19:12.772834       1 reflector.go:424] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
E1012 19:19:12.772862       1 reflector.go:140] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: Failed to watch *v1alpha1.CruiseControlOperation: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
W1012 19:19:25.467924       1 reflector.go:424] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
E1012 19:19:25.467952       1 reflector.go:140] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: Failed to watch *v1alpha1.CruiseControlOperation: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
W1012 19:19:48.829219       1 reflector.go:424] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope
E1012 19:19:48.829247       1 reflector.go:140] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: Failed to watch *v1alpha1.CruiseControlOperation: failed to list *v1alpha1.CruiseControlOperation: cruisecontroloperations.kafka.banzaicloud.io is forbidden: User "system:serviceaccount:kafka:kafka-operator" cannot list resource "cruisecontroloperations" in API group "kafka.banzaicloud.io" at the cluster scope

And the manager container would end up crashing

Additional context

The missing RBAC rules are copied from https://github.com/banzaicloud/koperator/blob/master/config/base/rbac/role.yaml, which got updated in PR #872 with the necessary access rights when the cruise control operation controllers were added

Checklist

  • Implementation tested

@panyuenlau panyuenlau requested a review from a team as a code owner October 12, 2022 19:23
Copy link
Member

@pregnor pregnor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@panyuenlau panyuenlau merged commit 909b737 into master Oct 12, 2022
@panyuenlau panyuenlau deleted the add-missing-rbac branch October 12, 2022 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants