-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Golang example on OpenShift 4.3 cannot produce deployments (finalizer RBAC error) #3477
Comments
@a-roberts can you try adding the following marker and running
|
HI @a-roberts, It shows duplicated of #3590. See my comment in #3590 (comment). I am closing this one and I'd like to ask for you follow up the #3590 if possible. However, if you do believes that it should be re-opened for any reason please feel free to ping and let us know. |
Reopening after I hit the same error while testing on Openshift 4.5.6:
The fix for me was to give the operator's ClusterRole permissions to update the memcached CR's finalizers, with the following marker in the controller:
- apiGroups:
- cache.example.com
resources:
- memcacheds/finalizers
verbs:
- get
- patch
- update @estroz @camilamacedo86 @joelanford Sorry if I missed it but did we discuss why we don't have the above in our docs and sample memcached controller to make the quickstart guide work by default on openshift (or any cluster with OwnerReferencesPermissionsEnforcement set). I know there's similar discussion for the same bug for Helm operators in #3767 (comment) which I think is for the same reason. |
Wouldn't call this a bug but definitely something to fix in the docs to make our quickstart example work on openshift by default. |
This came up for the Helm operator as well in #3767 What is it about OpenShift that causes this error that doesn't happen in vanilla Kubernetes? I'm curious if this is an OpenShift-specific API server customization, or if its an extra admission plugin that is not enabled by default in vanilla Kubernetes? The reason I ask: Should we push to get this permission added to the default scaffold in Kubebuilder? |
Given that this is built into upstream Kubernetes, I think we could make a case for including this in Kubebuilder's scaffolding. WDYT? |
Yeah that admission controller seems to be a reasonable default to have in any non-vanilla cluster. But in the meanwhile we should probably update our docs and sample controller to include a note on this so that our example works on openshift or any non-vanilla cluster. |
Hello, fyi, just ran into the same problem generating/installing the Go MemcachedStatus operator provided in https://github.com/operator-framework/operator-sdk/tree/master/testdata with.
and using OCP:
|
Hi @fckbo, The testdata/go/memcached operator has not the finalizer permission required for it works in OCP:
See: We added this permission in upstream kubernetes-sigs/kubebuilder#1688 but for v3+ plugin which means that it will ONLY be available to SDK when this plugin version is supported here whcih is not the current case. So, you can add the permission and run |
Hi @camilamacedo86, thx for your answer, this is what I had done....it worked... and sorry, I actually did not realise that the fix would be included only in a future release. Thx for clarifying. |
It is fine and really thank you for your collaboration 🥇 |
**Description of the change:** - Add the RBAC finalizer permission to allow users to test the Go sample project on OCP - See that for v3+ plugins this permission will be added by default - See that it was added as a NOTE to the quick start and by default in the tutorial in order to avoid the issue faced in #3477 **Motivation for the change:** Closes : #3477 Co-authored-by: Joe Lanford <joe.lanford@gmail.com>
…r-framework#4162) **Description of the change:** - Add the RBAC finalizer permission to allow users to test the Go sample project on OCP - See that for v3+ plugins this permission will be added by default - See that it was added as a NOTE to the quick start and by default in the tutorial in order to avoid the issue faced in operator-framework#3477 **Motivation for the change:** Closes : operator-framework#3477 Co-authored-by: Joe Lanford <joe.lanford@gmail.com> Signed-off-by: reinvantveer <rein.van.t.veer@geodan.nl>
Bug Report
What did you do?
Followed https://sdk.operatorframework.io/docs/golang/quickstart/
What did you expect to see?
Memcached pods appearing
What did you see instead? Under which circumstances?
No new pods. Above error comes from the logs of my operator.
Environment
0.19
1.14.5
OpenShift 4.3
Go
Possible Solution
Missing rbac in role.yaml surely, missing annotations somewhere to allow finalizer permissions?
Here's my generated role.yaml:
My reconcile method as per the example:
The text was updated successfully, but these errors were encountered: