Reflector return `invalid status code 'Forbidden'`

I find secret can not be copied into the new namespace sometimes. But I don‘t know what happened at all.

Does the reflector provide some information to help find the reason? for example, logs?

By the way, the following is the error log I find in reflector pod.

[ERR] (ES.Kubernetes.Reflector.Core.SecretMirror) Could not reflect tidb-admin/gateway-letsencrypt-secret to e2etesting-system-test-926-pool/gateway-letsencrypt-secret due to exception.
Microsoft.Rest.HttpOperationException: Operation returned an invalid status code 'Forbidden'
   at k8s.Kubernetes.SendRequestRaw(String requestContent, HttpRequestMessage httpRequest, CancellationToken cancellationToken)
   at k8s.Kubernetes.CreateNamespacedSecretWithHttpMessagesAsync(V1Secret body, String namespaceParameter, String dryRun, String fieldManager, String fieldValidation, Nullable`1 pretty, IDictionary`2 customHeaders, CancellationToken cancellationToken)
   at k8s.KubernetesExtensions.CreateNamespacedSecretAsync(IKubernetes operations, V1Secret body, String namespaceParameter, String dryRun, String fieldManager, String fieldValidation, Nullable`1 pretty, CancellationToken cancellationToken)
   at ES.Kubernetes.Reflector.Core.Mirroring.ResourceMirror`1.ResourceReflect(KubeRef sourceId, KubeRef targetId, TResource sourceResource, TResource targetResource, Boolean autoReflection) in /src/ES.Kubernetes.Reflector/Core/Mirroring/ResourceMirror.cs:line 432

[winromulus]

Please try the new version. This issue should be fixed. Please reopen if this is still a problem (some scenarios are extremely hard to reproduce and help is required to validate the fix).

[Roming22]

I’ve also run into the issue. In my case, because I’m deploying the reflector using openshift-gitops, I needed to use kustomize to patch the subjects[0].namespace in the reflector ClusterRoleBinding to the namespace in which the reflector user was created.