Skip to content

Helm chart: fix rolebindings when watching multiple namespaces#444

Merged
HoustonPutman merged 2 commits intoapache:mainfrom
plumdog:fix-rolebindings-when-watching-multiple-namespaces
Jun 7, 2022
Merged

Helm chart: fix rolebindings when watching multiple namespaces#444
HoustonPutman merged 2 commits intoapache:mainfrom
plumdog:fix-rolebindings-when-watching-multiple-namespaces

Conversation

@plumdog
Copy link
Contributor

@plumdog plumdog commented May 24, 2022

Found that I was getting errors like:

error retrieving resource lock mynamespace1/88488bdc.solr.apache.org: leases.coordination.k8s.io "88488bdc.solr.apache.org" is forbidden: User "system:serviceaccount:system:solr-operator" cannot get resource "leases" in API group "coordination.k8s.io" in the namespace "mynamespace1"

I have deployed with the following values:

watchNamespaces: mynamespace1,mynamespace2

When I did a helm diff to switch off leader elections, I saw something like the following in the diff:

- # Source: solr-operator/templates/leader_election_role_binding.yaml
...
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: solr-operator-leader-election-rolebinding
-   namespace: mynamespace1
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: solr-operator-leader-election-role
- subjects:
-   - kind: ServiceAccount
-     name: solr-operator
-     namespace: system
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: solr-operator-leader-election-rolebinding
-   namespace: mynamespace2
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: solr-operator-leader-election-role
- subjects:
-   - kind: ServiceAccount
-     name: solr-operator
-     namespace: system

Which looks right, except for the missing ---, which is what this PR adds.

My workaround is to run with:

leaderElection:
  enable: false
replicaCount: 1

(1 is the default number of replicas anyway, but I imagine strange things happen with multiple replicas and no leader election, so important it is set to 1)

@HoustonPutman HoustonPutman added this to the main (v0.6.0) milestone May 25, 2022
Copy link
Contributor

@HoustonPutman HoustonPutman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great catch and fix, thanks so much for taking the time!

Would you mind adding a changelog entry real quick in the solr-operator helm chart yaml? You can add it to the end of the list, and just link the PR since this doesn't have an issue.

Signed-off-by: Andrew Plummer <plummer574@gmail.com>
@plumdog
Copy link
Contributor Author

plumdog commented May 25, 2022

@HoustonPutman Happy to help!

I think I have now put the right thing into Chart.yaml.

@HoustonPutman HoustonPutman added bug Something isn't working helm labels Jun 7, 2022
@HoustonPutman HoustonPutman merged commit 563638a into apache:main Jun 7, 2022
@plumdog plumdog deleted the fix-rolebindings-when-watching-multiple-namespaces branch June 7, 2022 15:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working helm

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants