Scope reconciler to single namespace

[tim-hilt]

We have to migrate our infrastructure from one cluster to another one, where we can only use a single namespace. This is problematic for our CRDs, because they usually need cluster-level access.

The installation can be done by the admins of the new cluster, but during runtime I need the operator to run in a single namespace without requesting or trying to watch resources from outside of its namespace.

How can I achieve this within a kubebuilder-project? Are there any possibilities that I just haven't found out about until now?

[serhermar]

Hi @tim-hilt !

If you need deploy your operator in a single namespace and control that namespace, you can make next steps:

1. In xxxx_controller.go add next permissions:

//+kubebuilder:rbac:groups=group.domain.com,namespace=xxxxxx,resources=kindAPI,verbs=get;list;watch;create;update;patch;delete
[...]

After that your role.yaml is generated with Role permissions instead ClusterRole permissions.

You can check the documentation in here

2. Add to your operator compatibility with multinamespace support. You can add a new flag (namespaces), that is a list of namespaces to watch. If this flag is empty the operator is cluster-wide and if you put for example --namespaces="ns1,ns2" the operator watch this namespace. To watch the specified namespaces in main.go you must add new Cache with cache.MultiNamespacedCacheBuilder function.

Example:

ctrl.Options.NewCache = cache.MultiNamespacedCacheBuilder([]Strings)

You can check the documentation in here

And you can check the kubebuilder documentation with example in here

I hope that i help you!

[camilamacedo86]

HI @tim-hilt,

By default, the projects are scaffolded with a cluster-scope. However, you could change that for namespaced-scope. The best doc to help you out with seems to leave in the SDK repo, see: https://sdk.operatorframework.io/docs/building-operators/golang/operator-scope/

Would be great if we have a tutorial in Kubebuilder docs about it and how to change the scope of your operator from cluster to namespaced one. Would you like to contribute with? If so, please feel free to push some PR.

[tim-hilt]

Thanks for the answer! Unfortunately I’m deeply buried in other doings atm and am pretty far away from writing custom operators. I don’t think that I’m able to contribute right now, but I’ll keep the suggestion in mind. 🙂

[tikr7]

@camilamacedo86 as @serhermar already linked in the post above, the "kubebuilder-scope" is kinda documented here: https://book.kubebuilder.io/cronjob-tutorial/empty-main.html
It includes SingleNamespace and MultiNamespace

It is just not that easy to find like: https://sdk.operatorframework.io/docs/building-operators/golang/operator-scope/

[camilamacedo86]

Closing since it is answered.