opentelemetry collector helm clusterrole missing replicaset

[blackluck]

Updated to 0.59.1 helm chart opentelemtry-collector (from 0.56.0) and in collector logs saw errors like this:

W0601 12:16:08.649920 1 reflector.go:533] k8s.io/client-go@v0.27.1/tools/cache/reflector.go:231: failed to list *v1.ReplicaSet: replicasets.apps is forbidden: User "system:serviceaccount:telemetry:opentelemetry-collector" cannot list resource "replicasets" in API group "apps" at the cluster scope
E0601 12:16:08.650003 1 reflector.go:148] k8s.io/client-go@v0.27.1/tools/cache/reflector.go:231: Failed to watch *v1.ReplicaSet: failed to list *v1.ReplicaSet: replicasets.apps is forbidden: User "system:serviceaccount:telemetry:opentelemetry-collector" cannot list resource "replicasets" in API group "apps" at the cluster scope

k8s version 1.24

After updating helm values clusterRole rules like this:

  rules:
    - apiGroups:
      - ""
      resources:
      - pods
      - replicasets
      - namespaces
      verbs:
      - get
      - watch
      - list
    - apiGroups:
      - apps
      resources:
      - replicasets
      verbs:
      - get
      - watch
      - list

The issue is solved, but I guess this should be in the default helm values.

Thanks

[TylerHelmuth]

@blackluck the default rules for the chart's clusterrole are pretty thin by design. They are extended automatically by certain presets to fulfill those componet's requirements. For example, the clusterMetrics preset adds all of these:

{{- if .Values.presets.clusterMetrics.enabled}}
  - apiGroups: [""]
    resources: ["events", "namespaces", "namespaces/status", "nodes", "nodes/spec", "pods", "pods/status", "replicationcontrollers", "replicationcontrollers/status", "resourcequotas", "services" ]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["daemonsets", "deployments", "replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["autoscaling"]
    resources: ["horizontalpodautoscalers"]
    verbs: ["get", "list", "watch"]
  {{- end}}

Which includes replicaset for apps.

Were you installing the default collector configuration for had you modified it to use a specific receiver like the k8sclusterreceiver?

[povilasv]

I think the issue is basically new version of k8sattribute processor doesn't depend on parsing names using regex, but actually ask for Replicasets / Jobs / to see owner references.