devdattakulkarni
commented
4 years ago All the client-go functions support passing in Namespace name in their CRUD calls. The sample-controller code is already written to parse and use namespace field from input YAMLs. So yes, you can restrict your code to make calls for objects in a particular namespace. If you pass the namespace field as "" (empty string) in a list call, then that call goes out to all namespaces.
Regarding above error, it is showing up in the reflector which is the entity in client-go that behind the scene tries to retrieve objects from API server and cache them locally. The sample-controller then works with these cached objects. Access of client-go's reflector to the API server is also controlled by same RBAC rules as any other entity that is trying to make calls to the API server. To solve above error you will have to define RBAC policies in your cluster. Generally you will deploy your controller as a Pod and define RBAC rules for that Pod's 'serviceAccount'. If you are just trying out sample controller I would recommend enabling cluster admin permissions for your kubeconfig context user. If you are using minikube then you will have these permissions already. If not, you can follow these steps. They are bit involved -- create a ServiceAccount, grant it cluster admin permissions, get that SA's token, update your kubeconfig context to use that SA, and then try running sample-controller. Using minikube might be simpler option if these steps seem complicated.
fejta-bot
k8s-ci-robot
Hello,
I am trying to play with sample controller without a cluster role. I saw a bunch of error messages like this:
Is there a way to ask the sample controller only list from certain namespace? Or is it by design that most of the CRD operator need to have the permission to list CRDs in all namespaces? Thanks in advance.
Regards, Shuo