Operator not working on okd 4.14 because of rbac issues

[Elyytscha]

i wasn't able to install the operator successfully on openshift, the operator was crashlooping because of permission errors for clusterkeycloaks and clusterkeycloakrealms api's

i added the following crb's to fix it

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: edp-keycloak-operator-controller-manager-clusterkeycloakrealms
subjects:
  - kind: ServiceAccount
    name: edp-keycloak-operator-controller-manager
    namespace: openshift-operators
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: clusterkeycloakrealms.v1.edp.epam.com-v1alpha1-admin
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: edp-keycloak-operator-controller-manager-clusterkeycloaks
subjects:
  - kind: ServiceAccount
    name: edp-keycloak-operator-controller-manager
    namespace: openshift-operators
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: clusterkeycloaks.v1.edp.epam.com-v1alpha1-admin

[MykolaMarusenko]

Hello @Elyytscha !

Could you kindly provide some clarification on the process for installing the operator? Are you utilizing Operatorhub for this purpose? We will check this case.

Thank you for contribution!

[Elyytscha]

i thought because i wrote openshift it would be clear that its handled by olm via subscription :)

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: edp-keycloak-operator
  namespace: openshift-operators
spec:
  channel: alpha
  installPlanApproval: Automatic
  name: edp-keycloak-operator
  source: community-operators
  sourceNamespace: openshift-marketplace
  startingCSV: edp-keycloak-operator.v1.19.0

i'm sorry for not communicating it correctly initially

[Elyytscha]

and because i forgot this too..:

its the default openshift community operator catalog (not the operatorhub catalog directly) but imo there should be no difference, because on both catalogs v1.19.0 is the latest version for the edp keycloak operator

[alezander86]

Hello @Elyytscha!

Thank you for reaching out. As the installation was carried out via Operator Hub, the operation in cluster-wide mode "clusterReconciliationEnabled: false" has been disabled. This is why ClusterRole and ClusterRoleBinding weren't created.

For your specific scenario, we recommend that you utilize our repository with the edp-cluster-addons approach. Alternatively, you can directly install the chart following the provided instructions, please do not forget to redefine respective values.

It's worth noting that both approaches come with the updated 1.20.0 version of our operator.

If you have any more questions, feel free to reach out.

[Elyytscha]

Thank you for reaching out. As the installation was carried out via Operator Hub, the operation in cluster-wide mode "clusterReconciliationEnabled: false" has been disabled. This is why ClusterRole and ClusterRoleBinding weren't created.

may I ask why this is the cause, I installed the operator in clustermode, why cluster mode is then disabled?

For your specific scenario, we recommend that you utilize our repository with the edp-cluster-addons approach. Alternatively, you can directly install the chart following the provided instructions, please do not forget to redefine respective values.

I would really like to avoid helm and utilize olm for installing operators

[alezander86]

may I ask why this is the cause, I installed the operator in clustermode, why cluster mode is then disabled?

We did not take this into account for this installation mode, now we have made these fixes in a future release, which will already be mandatory

I would really like to avoid helm and utilize olm for installing operators

I understand, thanks again for participating in the development of the project.