Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Allow ambassador Helm chart to use CRDS when namespaced

See original GitHub issue

Describe the bug I have a ambassador instance deployed as a namespaced resource and get the following

2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: looking up ID for namespace god-default
2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for authservices.getambassador.io: Forbidden
2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for mappings.getambassador.io: Forbidden
2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for modules.getambassador.io: Forbidden
2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for ratelimitservices.getambassador.io: Forbidden
2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for tcpmappings.getambassador.io: Forbidden
2019-05-29 08:34:51 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for tlscontexts.getambassador.io: Forbidden
2019-05-29 08:34:52 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRD type definition unreadable for tracingservices.getambassador.io: Forbidden
2019-05-29 08:34:52 kubewatch [32 TMainThread] 0.70.1 DEBUG: CRDs are not available. To enable CRD support, configure the Ambassador CRD type definitions and RBAC, then restart the Ambassador pod.

To Reproduce Steps to reproduce the behavior:

Deploy crds
Deploy ambassador using namespaced: true
ambassador rolls back to annotation only mode

Expected behavior Ambassador should be able to read CRDS depoyed within its namespace without using ClusterRole RBAC definitions

Versions (please complete the following information):

Ambassador: 0.70.1
Kubernetes environment GKE

Issue Analytics

State:
Created 4 years ago
Reactions:1
Comments:21 (10 by maintainers)

Top GitHub Comments

2reactions

volatilemolotovcommented, Jun 10, 2019

Best way IMHO is to fallback to annotations if no custom resources are found and log it in the stdout. If someone cannot reach its mapping or ambasador itself first thing would be to check the logs. Pod should not crash because you still can use annotations which can be considered as a ready state

1reaction

kflynncommented, Jun 7, 2019

@bourquep That is definitely a bug, yes.