Messaging Topology Operator permission denied when reconciling user credentials secret #748
-
Hi, I've been struggling with a permissions issue for a few days so I thought I'd post here to see if anybody can help. I have a K8s cluster running on AWS EKS and the messaging topology operator is giving the following error log: {
"level": "error",
"ts": "2024-01-23T09:54:24Z",
"msg": "Reconciler error",
"controller": "user",
"controllerGroup": "rabbitmq.com",
"controllerKind": "User",
"User": {
"name": "user",
"namespace": "default"
},
"namespace": "default",
"name": "user",
"reconcileID": "7d5162d8-a0f8-4d3e-b98f-56fab80603dc",
"error": "secrets \"user-credentials\" is forbidden: User \"system:serviceaccount:rabbitmq-system:messaging-topology-operator\" cannot update resource \"secrets\" in API group \"\" in the namespace \"default\"",
"stacktrace": "sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:324\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:265\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:226"
} Cluster Operator and Messaging Topology Operator are in the rabbitmq-system namespace. They have been installed with the provided k8s manifests here and here respectively. The RabbitmqCluster has been deployed in the default namespace and is reconciled successfully from the following manifest: apiVersion: rabbitMqManifestApiVersion,
kind: "RabbitmqCluster",
metadata: {
annotations: {
"rabbitmq.com/topology-allowed-namespaces": "default",
},
name: rabbitMqClusterName,
},
spec: {
replicas: 1,
resources: {
limits: {
cpu: "100m",
memory: "0.5Gi",
},
requests: {
cpu: "100m",
memory: "0.5Gi",
},
},
}, The Secret, User and Permission have the following manifest but is failing: {
apiVersion: "v1",
kind: "Secret",
metadata: {
name: "user-credentials",
},
stringData: {
password: "mypass",
username: "username",
},
type: "Opaque",
},
{
apiVersion: "rabbitmq.com/v1beta1",
kind: "User",
metadata: {
name: "username",
},
spec: {
importCredentialsSecret: {
name: "user-credentials",
},
rabbitmqClusterReference: {
name: rabbitMqClusterName,
},
},
},
{
apiVersion: "rabbitmq.com/v1beta1",
kind: "Permission",
metadata: {
name: "user-permission",
},
spec: {
permissions: {
configure: ".*",
read: ".*",
write: ".*",
},
rabbitmqClusterReference: {
name: rabbitMqClusterName,
},
user: "username",
vhost: "/",
},
},
Can anybody spot the misconfiguration? From reading the docs it seems like that role should have permission to reconcile in the default namespace and read/write secrets. |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 3 replies
-
This feels like a question for @Zerpet or @MirahImage 🤞 |
Beta Was this translation helpful? Give feedback.
-
It seems like the role is missing
And the role definition:
Indeed looks like it does not have permissions to messaging-topology-operator/config/rbac/role.yaml Lines 15 to 23 in 35b16b5 What version of the Topology Operator are you running? It's probably the latest, given your post, but it doesn't hurt to double check. Inspecting the image field in the |
Beta Was this translation helpful? Give feedback.
I can't reproduce the issue in our latest 1.13.0 release. I don't think the new minor changed anything significant that would resolve this specific issue.
The only thing I can think of, it's if you create a
Secret
with the same name as we would create. Our operator generates aSecret
with the name<user.metadata.name>-user-credentials
. For example, if you create aSecret
namedfoo-user-credentials
, and then create aUser
namedfoo
, our Operator will try to create aSecret
that you have already created, and update it to set an owner reference.Can you confirm if this is the case?