Jaeger Operator Chart missing list permisson

[cfontes]

Hi,

First, thanks for this. It's super helpful.

But we just had an issue while deploying the operator with this chart, the log message we got was

"pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:125: Failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:observability:jaeger-operator" cannot list resource "namespaces" in API group "" at the cluster scope"

After some investigation it looks like this chart is missing the list permission on some resources, and when comparing the Helm Role.YAML file to Jaeger-Operator there are some differences and specifically you see all list permissions are missing.

After applying the Jaeger-Operator file to our cluster, the Jaeger Operator was back to normal and deployed Jaeger and all it's dependencies.

[MrAprksn]

Same here.
When installing jaeger-operator with rbac.clusterRole: true created ClusterRole is missing - namespaces permission in apiGroups ""

[tirumerla]

I'm running into the same issue. Would be great to fix this. As a workaround i have created custom template with another ClusterRole, ClusterRoleBinding attached to the same serviceaccount created with the chart.

[perezjasonr]

I'm running into this issue as well, with clusterRole false

rbac:
  # Specifies whether RBAC resources should be created
  create: true
  clusterRole: false

even with clusterRole false, its trying to list namespaces:

Failed to watch *v1.Namespace: failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:observability:jaeger-operator" cannot list resource "namespaces" in API group "" at the cluster scope

but we wanted our jaeger to be more limited, is this not allowed? if so why are we allowed to set this to false?

[perezjasonr]

it looks like it made a role and put namespaces anyways:

apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
...
...
  - apiGroups:
    - ""
    resources:
    - namespaces
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - get
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - rbac.authorization.k8s.io
    resources:
    - clusterrolebindings
    verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch

but i guess my question is why is it trying to list namespaces if we dont want it to have a clusterrole, is confining jaeger to an ns not supported anymore?

[sereneshikari]

but i guess my question is why is it trying to list namespaces if we dont want it to have a clusterrole, is confining jaeger to an ns not supported anymore?

Hey @perezjasonr, I know it's almost been a year since you last commented here but were you able to figure out the reason for this? I'm running into the same problem with the latest Jaeger operator (1.38.0 at the time of writing)