Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set namespsace for metrics to WATCH_NAMESPACE #2078

Closed
wants to merge 1 commit into from

Conversation

mattmb
Copy link

@mattmb mattmb commented Oct 17, 2019

Often the operator is in the same namespace as the things it's watching
and this works okay. We deploy the operator to a different namespace.
Anyway, I think this should be the watch namespace since that's where
we're expecting the CRDs to be.

Often the operator is in the same namespace as the things it's watching
and this works okay. We deploy the operator to a different namespace.
Anyway, I think this should be the watch namespace since that's where
we're expecting the CRDs to be.
@openshift-ci-robot openshift-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Oct 17, 2019
@openshift-ci-robot
Copy link

Hi @mattmb. Thanks for your PR.

I'm waiting for a operator-framework or openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 17, 2019
@@ -198,7 +198,7 @@ func serveCRMetrics(cfg *rest.Config) error {
return err
}
// Get the namespace the operator is currently deployed in.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably should update this comment too, since it's no longer accurate

@fabianvf
Copy link
Member

/ok-to-test

@openshift-ci-robot openshift-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 18, 2019
Copy link
Contributor

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HI @mattmb,

Really thank you for your contribution. 🥇

However, IMHO we should NOT use the GetWatchNamespace() by default in the scaffold project. Note that this change just will just work if the WatchNamespace is a List of Namespaces since if the operator is namespace scoped then it means that it also should be the operator namespace. Then, if the operator is cluster scoped it will be "". For more info see the doc

Also, users are able to customize the scaffold as they wish but in order to keep the scaffold project and the common scenarios working then make sense the usage of the Operator Namespace.

PS.: Since it is passing in the tests it means that we are not checking the metrics with a cluster scope operator. It is something that we could improve. Tracked it here: #2084

c/c @fabianvf

@mattmb
Copy link
Author

mattmb commented Oct 21, 2019

Ah, interesting, thanks for the context. I wasn't aware you could have multiple watch namespaces...

Some context on why I was trying to fix this. When I deployed a new operator with the latest version of the sdk the log was full with:

pkg/mod/k8s.io/client-go@v11.0.1-0.20190409021438-1a26190bd76a+incompatible/tools/cache/reflector.go:94: Failed to list *unstructured.Unstructured: thing.foo.com is forbidden: User "system:serviceaccount:operators:thing-operator" cannot list resource "thing" in API group "foo.com" in the namespace "operators"

I suspect the operator is still okay but just because we don't give the operators much permission in their own namespace the metrics code is failing. Given your context maybe a better solution is a toggle to make it easy to disable the metrics collection/serving?

@camilamacedo86
Copy link
Contributor

Hi @mattmb,

Really thank you for your understanding. So, do you agree that would not be the best approach to move forward here? Are you ok with we close this PR?

Also, regards any issue that you may have been facing with the new release could you please raise an issue for we check and are able to help you with instead of we check if here?

@camilamacedo86
Copy link
Contributor

Hi @mattmb,

I am closing this one based on the comments made above. However, please feel free to re-open if you see that is required. Thank you for your contribution.

camilamacedo86 added a commit that referenced this pull request Feb 18, 2020
… to Ansible/Helm operators to handle [multinamespace caching] (#2522)

**Motivation for the change:**

- Integration with OLM: See that OLM allows and config the MultiNamespace via the option  `targetNamespaces` via the OperatorGroup. We are also in the olm commands setting these values in the WATCH-NAMESPACE EnvVar. 

- Address the requirements requested in tasks such as #2494, #2078, (which are a very common scenario in the channels: I as an operator dev, would like to deploy the operator in the nsA and WATCH the resources in the nsB and do not all cluster ), 

Closes #2361
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants