Use Role and RoleBinding for namespace scoped operator failed

Hi Community,

I want to use a Role and RoleBinding to build a namespace scoped k8s operator. Only control the CR events in one namespace. If I change this to ClusterRole, ClusterRoleBinding. The problem will be gone. I just want to check if it is possible to make it Role and Rolebinding. My CRD is namespaced scoped.

I am getting the error

2022-02-17 00:01:24,203 ERROR org.apache.flink.kubernetes.operator.KubernetesOperatorEntrypoint [] - Exception occurred, but caught
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.96.0.1/apis/flink.operator.io/v1/flinkapplications. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. flinkapplications.flink.operator.io is forbidden: User "system:serviceaccount:default:flink-native-k8s-operator" cannot list resource "flinkapplications" in API group "flink.operator.io" at the cluster scope.

This is my main class. Maybe I misused some APIs? Please suggest. Thanks!!!

  public static void main(String[] args) {

    try (KubernetesClient k8sClient = new DefaultKubernetesClient()) {
      String namespace = k8sClient.getNamespace();
      if (namespace == null) {
        LOG.info("No namespace found via config, assuming default.");
        namespace = "default";
      }

      LOG.info("Using namespace : " + namespace);

      final SharedInformerFactory informerFactory = k8sClient.informers();

      SharedIndexInformer<FlinkApplication> flinkAppinformer = informerFactory.sharedIndexInformerFor(FlinkApplication.class, 30 * 1000L);

      if (Constants.OPERATOR_WATCH_LEVEL.equalsIgnoreCase("namespace")) {
        flinkAppinformer = informerFactory
                .sharedIndexInformerFor(FlinkApplication.class, new OperationContext().withNamespace(namespace), 30 * 1000L);
      }

      LOG.info("Flink operator running in {} mode. In namespace mode, it will only watch {} namespace" +
                      " (the namespace operator is deployed) for Flink CR change events, " +
                      "In cluster mode, it will watch all namespaces' Flink CR change events.",
              Constants.OPERATOR_WATCH_LEVEL, namespace);

      MixedOperation<FlinkApplication, FlinkApplicationList, Resource<FlinkApplication>> flinkAppK8sClient
        = k8sClient.customResources(FlinkApplication.class, FlinkApplicationList.class);

      FlinkApplicationController flinkApplicationController = new FlinkApplicationController(
        k8sClient,
        flinkAppK8sClient,
        flinkAppinformer,
        namespace);

      flinkApplicationController.create();
      informerFactory.addSharedInformerEventListener(
        exception -> LOG.error("Exception occurred, but caught", exception));
      final Future<Void> startInformersFuture = informerFactory.startAllRegisteredInformers();
      startInformersFuture.get();

      flinkApplicationController.run();
    } catch (Exception exception) {
      LOG.error("Kubernetes Client Exception : ", exception);
    }
  }

[rohanKanojia]

You’ll need to specify inNamepace in SharedInformerFactory in order to have namespaced informer:

SharedIndexInformer<FlinkApplication> flinkAppinformer = informerFactory.inNamespace("test").sharedIndexInformerFor(FlinkApplication.class, 30 * 1000L);

Or use more flexible DSL inform method:

SharedIndexInformer<FlinkApplication> flinkAppinformer = client.resources(FlinkApplication.class).inNamespace("test").inform(new ResourceEventHandler<FlinkApplication>() {
  @Override
  public void onAdd(FlinkApplication obj) {
    
  }

  @Override
  public void onUpdate(FlinkApplication oldObj, FlinkApplication newObj) {

  }

  @Override
  public void onDelete(FlinkApplication obj, boolean deletedFinalStateUnknown) {

  }
});

[manusa]

If everything is namespaced, and your Role and RoleBiding are properly configured, everything should work.

I recall there might be some issues with some older versions of the Client and namespaced usage of SharedInformers (@shawkins)