search

oracle / oracle-database-operator

The Oracle Database Operator for Kubernetes (a.k.a. OraOperator) helps developers, DBAs, DevOps and GitOps teams reduce the time and complexity of deploying and managing Oracle Databases. It eliminates the dependency on a human operator or administrator for the majority of database operations.
Universal Permissive License v1.0
140 stars 45 forks source link

OraOperator 1.1 cannot reconcile on SingleInstanceDatabases and PDBs properly #148

Open ilfur opened 1 month ago

ilfur commented 1 month ago

First I thought this was my own setup problem in my environment. Now I tried a new OBaaS 1.3 quick install and found that the included OraOperator has the same problem. So here is the problem and a quick fix for it:

OraOperator container log shows error messages of the kind pkg/mod/k8s.io/client-go@v0.29.2/tools/cache/reflector.go:229: failed to list *v1.Node: nodes is forbidden: User "system:serviceaccount:oracle-database-operator-system:default" cannot list resource "nodes" in API group "" at the cluster scope So resources like SingleInstanceDatabase and even PDBs will not show proper status , connect infos and stuff. Provisioning them is working though. I needed to apply one more Role for that to work. Please add that Role (to list and watch nodes everywhere) to the OraOperator installation yamls. Here is my example:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: oracle-database-operator-manager-role-node
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oracle-database-operator-manager-role-node-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: oracle-database-operator-manager-role-node
subjects:
- kind: ServiceAccount
  name: default
  namespace: oracle-database-operator-system
---
IshaanDesai45 commented 4 weeks ago

@ilfur this role and roleBinding was decoupled because users generally don't want to give operator pod access to the nodes by default which might become a security concern. If you use a LoadBalancer service instead of a NodePort service you won't face this problem