search

hashicorp / vault-k8s

First-class support for Vault and Kubernetes.
Mozilla Public License 2.0
786 stars 169 forks source link

enable logging from operator-lib #608

Closed tvoran closed 7 months ago

tvoran commented 7 months ago

Uses a logging type from consul to wrap an hclog logger in logr's LogSink type. This also turned up a missing ClusterRole permission for getting Nodes from k8s.

Fixes #605

ClusterRole permissions also added to the chart in https://github.com/hashicorp/vault-helm/pull/1005

Related to https://github.com/hashicorp/vault-helm/issues/980 and https://github.com/hashicorp/vault-helm/issues/725

Log samples:

[ERROR] handler.operator-lib.leader: Failed to get Node: error="nodes \"kind-control-plane\" is forbidden: User \"system:serviceaccount:vault:vault-agent-injector\" cannot get resource \"nodes\" in API group \"\" at the cluster scope" Node.Name=kind-control-plane
[DEBUG] handler.operator-lib.leader: Not the leader. Waiting.
tvoran commented 7 months ago

What does the library actually need the nodes information for? i.e. this is just informational, the leader elections aren't broken without it right?

@tomhjp It's used to check for the case where the leader is stuck on a notReady k8s Node as I understand it: https://github.com/operator-framework/operator-lib/blob/b51f67c33ce55e3a148187047f7de70dd4f87d9d/leader/leader.go#L189-L196

So in general it was working for us, but would have trouble with that specific case.

tomhjp commented 7 months ago

Awesome, thanks for the context - that's a great bit of extra resilience to have 👍