harksodje
commented
2 years ago @paul-snively, I am currently experiencing the same issue.
Open paul-snively opened 2 years ago
harksodje
commented
2 years ago @paul-snively, I am currently experiencing the same issue.
harksodje
commented
2 years ago @paul-snively, I was able to resolve this issue. The clusterrolebinding of the schema-registry is referencing wrong namespace. This is default:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
meta.helm.sh/release-name: kafka
meta.helm.sh/release-namespace: kafka
creationTimestamp: "2022-10-25T14:49:15Z"
labels:
app.kubernetes.io/managed-by: Helm
name: strimzi-registry-operator
resourceVersion: "12193"
uid: 60fa9e7a-d0bb-4811-8a94-e65a31378456
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: strimzi-registry-operator
subjects:
- kind: ServiceAccount
name: strimzi-registry-operator
namespace: strimzi-registry-operatorI just changed the
karanalang
commented
1 year ago faced similar issue, resolved by creating the ServiceAccount in namespace - 'strimzi-registry-operator'
husker-du
commented
1 year ago The property operatorNamespace of the strimzi-registry-operator sets the namespace where the operator is going to be installed, by default this value is set to the namespace strimzi-registry-operator. Therefore, the helm release has to be deployed in this namespace by setting the option -n strimzi-registry-operator. If this namespace does not exists, it can be created by the helm command using the option --create-namespace.
In summary, the following command deploys the strimzi-registry-operator in the strimzi-registry-operator namespace for a strimzi Kafka cluster named kafka-cluster deployed in the strimzi namespace:
$ helm upgrade --install --create-namespace strimzi-registry-operator lsstsqre/strimzi-registry-operator --set clusterNamespace=strimzi,clusterName=kafka-cluster,operatorNamespace=strimzi-registry-operator -n strimzi-registry-operatorThe property operatorNamespace=strimzi-registry-operator can be omitted because this is the default value.
karanalang
commented
1 year ago Hi Carlos,
Can you pls check issue # 84 as well ?
https://github.com/lsst-sqre/strimzi-registry-operator/issues/84
This is in pending state, and not assigned to anyone yet.
thanks, Karan Alang
On Mon, Dec 26, 2022 at 7:59 AM Carlos Tomás @.***> wrote:
The property operatorNamespace of the strimzi-registry-operator sets the namespace where the operator is going to be installed, by default this value is set to the namespace "strimzi-registry-operator". Therefore, the helm release has to be deployed in this namespace by setting the option -n strimzi-registry-operator. If this namespace does not exists, it can be created by the helm command using the option --create-namespace.
In summary, the following command deploys the strimzi-registry-operator in the strimzi-registry-operator namespace for a strimzi Kafka cluster named kafka-cluster deployed in the strimzi namespace:
$ helm upgrade --install --create-namespace strimzi-registry-operator lsstsqre/strimzi-registry-operator --set clusterNamespace=strimzi,clusterName=kafka-cluster,operatorNamespace=strimzi-registry-operator -n strimzi-registry-operator The property operatorNamespace=strimzi-registry-operator can be omitted because this is the default value.
— Reply to this email directly, view it on GitHub https://github.com/lsst-sqre/strimzi-registry-operator/issues/79#issuecomment-1365260271, or unsubscribe https://github.com/notifications/unsubscribe-auth/ADKEGTHHUSOZ62V5VC3SL33WPG6FVANCNFSM6AAAAAARAXHES4 . You are receiving this because you commented.Message ID: @.***>
strowi
commented
1 year ago Hi,
ran into a similar issue where the ServiceAccount seems to be missing permissions. With version 2.1.0 i had to patch the ClusterRole to get rid of the following 2:
kopf._cogs.clients.w [DEBUG ] Stopping the watch-stream for customresourcedefinitions.v1.apiextensions.k8s.io cluster-wide
kopf._cogs.clients.w [DEBUG ] Stopping the watch-stream for namespaces.v1 cluster-wide.I just added them to an appropriate rule instead of creating an extra one:
rules:
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- list
- get
**- watch**
- apiGroups:
- ""
resources:
- secrets
- configmaps
- services
**- namespaces**
verbs:
- get
- list
- watch
- patch
- createMaybe this can help someone else stumbling over this.
Setup:
Minikube 1.27.0 Kubernetes 1.23. Strimzi 0.13.1 installed via OperatorHub
KafkaCluster "kafka" created in namespace "moonraker" registry-schemas KafkaTopic in namespace "moonraker" ready confluent-schema-registry KafkaUser in namespace "moonraker" ready
Install operator via:
helm install -n operators schema-registry lsstsqre/strimzi-registry-operator --set clusterName="kafka",clusterNamespace="moonraker"Logs from the operator pod:
It seems the created ServiceAccount doesn't have the permissions it needs to do what it needs to do.