nifikop tries to delete nifiusers in other namespaces while deleting nificluster

[teplydat]

Bug Report

What did you do?

• the operator is scoped to a specific namespace
• the nificluster has nifiusers and nifigroups configured
• when deleting the nificluster (cr) there comes the following error message:

  2021-05-25T13:08:26.505Z    ERROR   controller-runtime.manager.controller.nificluster   Reconciler error    {"reconciler group": "nifi.orange.com", "reconciler kind": "NifiCluster", "name": "nifi", "namespace": "WHATEVER", "error": "nifiusers.nifi.orange.com is forbidden: User \"MYUSER\" cannot deletecollection resource \"nifiusers\" in API group \"nifi.orange.com\" in the namespace \"openshift-kube-controller-manager\""}

• a deletion is not possible because the operator is stuck at this point

What did you expect to see? Nifikop shouldn't try delete nifiusers in other namespaces where the operator is not scoped to. The deletion of the nificluster should just work.

Environment

• nifikop version: 0.6.1 and below

[erdrix]

Could you give me the configuration of the environment variable WATCH_NAMESPACE in the NiFiKop pod ? And say me if the user associated to the NiFiKop pod has the correct accesses to delete the nifi resources in openshift-kube-controller-manager namespace ?

[teplydat]

my launch.json (for vscode debugging):

    "go.testEnvVars": {
        "WATCH_NAMESPACE": "default",
    },
    "version": "0.2.0",
    "configurations": [
        {
            "env": {
                "WATCH_NAMESPACE": "default",
...

So it uses the correct namespace (where my nificluster is deployed).

No my user has no permissions in namespace openshift-kube-controller-manager. Nifikop should not get permissions in namespace openshift-kube-controller-managerif it is only scoped to namespace default

Please have a look in PR #106. I think then it gets clearer.

[erdrix]

I just released a new version (v0.6.2-release) containing the PR#109 that should fix your issues.

[teplydat]

@erdrix thank you very much. I tested it and it works.