Closed sebboer closed 3 months ago
pmalek
commented
3 months ago Hi @sebboer,
What KIC version do you use? Can you post your values.yaml?
The change that adds the RBAC policy rules for this should already be included in kong 2.37.1 https://github.com/Kong/charts/commit/cb4483006a336d92fc5a3ddee7532e12bf9bc612 https://github.com/Kong/charts/blob/kong-2.37.1/charts/kong/templates/_helpers.tpl#L1644-L1661
sebboer
commented
3 months ago Coming from 2.36.0 I'm using KIC 3.0 that gets updated to 3.1.0 Changelog
values.yaml
admin:
enabled: true
http:
enabled: true
tls:
enabled: false
type: ClusterIP
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/instance: kong
app.kubernetes.io/name: kong
topologyKey: kubernetes.io/hostname
env:
NGINX_HTTP_CLIENT_MAX_BODY_SIZE: 0
NGINX_HTTP_PROXY_HTTP_VERSION: "1.1"
NGINX_PROXY_CLIENT_MAX_BODY_SIZE: 0
NGINX_PROXY_PROXY_HTTP_VERSION: "1.1"
PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
TRUSTED_IPS: 10.0.0.0/8
database: postgres
ingressController:
enabled: true
ingressClass: my-company-kong
installCRDs: false
watchNamespaces:
- my-company
manager:
enabled: false
nodeSelector:
kubernetes.io/arch: arm64
node.kubernetes.io/role: agent
portal:
enabled: false
serviceMonitor:
enabled: true
namespace: monitoringWe didn't account for watchNamespaces when we updated the policy RBAC rules for KongLicenses.
Before next version of the chart gets released you can disable the license controller (if you're not using its functionality .
sebboer
commented
3 months ago Thank you! The update now works after adding --enable-controller-kong-license=false.
pmalek
commented
3 months ago I'm glad that this is solved 👍
In case you'd like to test the proper fix, it will be released in the next version of kong helm chart.
Hello, I have a few problems updating the kong helmet chart and I don't know where to start. I have updated from 2.36.0 to 2.37.1 and updated the crds as follows.
The service account seems to have problems with the crds. KongLicenses cannot be listed and all other crds fail.
Here are some relevant logs of the failing ingress controller