[
https://issues.apache.org/jira/browse/FLINK-32041?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17721192#comment-17721192
]
Tamir Sagi commented on FLINK-32041:
------------------------------------
Hey Gyula,
I also encountered something similar
{{HA is enabled, with RBAC}}
I checked the rolebinding between the service account
`dev-0-flink-clusters:dev-0-xsight-flink-operator-sa` and the corresponded
role({*}flink-operator{*}) which has been created by the operator using
*{{rbac.nodesRule.create=true, they both look fine.}}*
The operator watches 2 namespaces:
# its own: dev-0-flink-clusters
# dev-0-flink-temp-clusters
!https://lists.apache.org/api/email.lua?attachment=true&id=61qtwrnxlh722pvok8dtnzdt7t7k7drb&file=fe69ed8d14240d73b73f68176ee7fa4f13f2b0ee303676f8eea92b7bdee9ceb3!
!https://lists.apache.org/api/email.lua?attachment=true&id=61qtwrnxlh722pvok8dtnzdt7t7k7drb&file=c8a40ca61528174bd1667e3fcf10ba39e2224700198a69e828db80c66315719d!
{{Then I see}}
{{org.apache.flink.kubernetes.shaded.io.fabric8.kubernetes.client.KubernetesClientException","message":"Failure
executing: GET at: https://172.20.0.1/api/v1/nodes. Message:
Forbidden!Configured service account doesn't have access. Service account may
have been revoked. nodes is forbidden: User
"system:serviceaccount:dev-0-flink-clusters:{*}dev-0-xsight-flink-operator-sa{*}"
cannot list resource "nodes" in API group "" at the cluster scope."}}
{{could it be related to : kubernetes.rest-service.exposed.type? }}
> flink-kubernetes-operator RoleBinding for Leases not created in correct
> namespace when using watchNamespaces
> ------------------------------------------------------------------------------------------------------------
>
> Key: FLINK-32041
> URL: https://issues.apache.org/jira/browse/FLINK-32041
> Project: Flink
> Issue Type: Bug
> Components: Kubernetes Operator
> Affects Versions: kubernetes-operator-1.4.0
> Reporter: Andrew Otto
> Assignee: Andrew Otto
> Priority: Major
>
> When enabling [HA for
> flink-kubernetes-operator|https://nightlies.apache.org/flink/flink-kubernetes-operator-docs-main/docs/operations/configuration/#leader-election-and-high-availability]
> RBAC rules must be created to allow the flink-operator to manage k8s Lease
> resources. When not using {{{}watchNamespaces{}}}, the RBAC rules are
> created at the k8s cluster level scope, giving the flink-operator
> ServiceAccount the ability to manage all needed k8s resources for all
> namespaces.
> However, when using {{{}watchNamespaces{}}}, RBAC rules are only created in
> the {{{}watchNamepaces{}}}. For most rules, this is correct, as the operator
> needs to manage resources like Flink pods and deployments in the
> {{{}watchNamespaces{}}}.
> However, For flink-kubernetes-operator HA, the Lease resource is managed in
> the same namespace in which the operator is deployed.
> The Helm chart should be fixed so that the proper RBAC rules for Leases are
> created to allow the operator's ServiceAccount in the operator's namespace.
> Mailing list discussion
> [here.|https://lists.apache.org/thread/yq89jm0szkcodfocm5x7vqnqdmh0h1l0]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
