-
Notifications
You must be signed in to change notification settings - Fork 411
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Is it possible to deploy opentelemetry-operator without clusterrole, using role instead #3042
Comments
You mean for the operator itself? You should be able to, but as a Role only covers RBAC in a specific namespace, the operator deployed this way will only be able to affect resources in this namespace. You'll want to set the |
Let us know if that worked. I have seen this request before and it would be great to document it. |
In fact, I moved most of the setting in ClusterRole to Role but keep the get/list/watch persistentVolume in ClusterRole and remove delete/create/update/patch persistentVolume due to privilege limitation in my company. Operator was successfully deployed and Center Collector was successfully deployed too. Currently I’m solving the problem of auto instrumentation due to Instrument deployed but no pods generated. Not sure what makes auto instrumentation not work, still work on it. |
The |
!!! I will try again tomorrow to see if there is an InitContainer. Thanks so much for this helpful information. |
Hi, I created a role + rolebinding to cover the RBAC issues, but the operator cannot run in namespaced mode, even if the WATCH_NAMESPACE is configured.
In addition to this, after some time, the operator crashes and becomes unstable, which causes a lot of stream errors printed to the stderr:
|
After I spent a little bit of time, I found out that even though the operator is configured to watch namespace(s), there is some logic in the code, where the manager is doing a watch on
After I removed that specific line, the operator had no runtime issues. Because I never did any development on the otel-operator, I do not know the impact, any feedback/solution would be highly appreciated. |
If a single namespace is watched the cluster scope objects could be excluded. But it does seem that it would change the operator's feature set. |
In fact, I still fail on the auto instrumentation, no any initial container appeared on my application. I kinds of want to drop the operator, use the combination of plain yaml collector deployment + ingest the cleint agent jar to application vai initial comtainer setting in application's deployment yaml to let the application fulfill no any rebuild applciation image needed |
This is very puzzling to me. There isn't any difference between On a separate note, @pavolloffay @jaronoff97 do you know why we try to own Volumes and Claims here? I don't think we create any. |
good question... initially I thought it was related to statefulsets, but any PVs and PVCs would be under the statefulset management tree. I don't think there's a reason we need to keep that in there... |
Yes, it's perhaps bc of the statefulset. +1 on removing it if it is not required. |
Component(s)
No response
Describe the issue you're reporting
Is it possible to deploy opentelemetry-operator without clusterrole, using role instead?
My company doesn't want to grant me cluster admin privilege and ask me to use role and rolebing only to deploy this operator; however, first error happened
[email protected]/tools/cache/reflector.go:229: failed to list *v1.PersistentVolume: persistentvolumes is forbidden: User "system:serviceaccount:..." cannot list resource "persistentvolumes" in API group "" at the cluster scope
How could I solve it.....
The text was updated successfully, but these errors were encountered: