search

redhat-cop / namespace-configuration-operator

The namespace-configuration-operator helps keeping configurations related to Users, Groups and Namespaces aligned with one of more policies specified as a CRs
Apache License 2.0
204 stars 55 forks source link

Reconciliation loop with Role template in Kubernetes 1.23 #135

Closed zeppelinen closed 1 year ago

zeppelinen commented 1 year ago

The following template triggers eternal reconciliation loop

---
apiVersion: redhatcop.redhat.io/v1alpha1
kind: NamespaceConfig
metadata:
  name: test
spec:
  labelSelector:
    matchLabels:
      tenant: test
  templates:
    - objectTemplate: |
        apiVersion: rbac.authorization.k8s.io/v1
        kind: Role
        metadata:
            name: argo-workflows
            namespace: {{ .Name }}
        rules:
        - apiGroups:
            - ""
          resources:
            - pods
            - secrets
            - pods/logs
            - configmaps
            - services
            - serviceaccounts
            - persistentvolumes
            - persistentvolumeclaims
          verbs:
            - get
            - watch
            - patch
            - list
            - create
            - update
            - delete

Example of log:

2023-03-11T01:33:25.254Z    INFO    controllers.NamespaceConfig reconciling started {"namespaceconfig": "/test"}
2023-03-11T01:33:25.258Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.259Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.263Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are NOT equal
2023-03-11T01:33:25.264Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are equal
2023-03-11T01:33:25.276Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.277Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.281Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are equal
2023-03-11T01:33:25.282Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are NOT equal
2023-03-11T01:33:25.290Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.290Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.295Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are equal
2023-03-11T01:33:25.296Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are NOT equal
2023-03-11T01:33:25.306Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.306Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.312Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are equal
2023-03-11T01:33:25.320Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are NOT equal
2023-03-11T01:33:25.331Z    INFO    controllers.NamespaceConfig reconciling started {"namespaceconfig": "/test"}
2023-03-11T01:33:25.331Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.331Z    INFO    resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    reconcile called for    {"object": "rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows", "request": "test-workflowtplcicdbak84/argo-workflows"}
2023-03-11T01:33:25.335Z    DEBUG   resource-reconciler./test.rbac.authorization.k8s.io/v1/Role/test-workflowtplcicdbak84/argo-workflows    determined that resources are equal
zeppelinen commented 1 year ago

My bad, there was another operator creating the same test role