Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fail to list APF resources when the Visibility API is turned on #1430

Closed
astefanutti opened this issue Dec 8, 2023 · 1 comment · Fixed by #1431
Closed

Fail to list APF resources when the Visibility API is turned on #1430

astefanutti opened this issue Dec 8, 2023 · 1 comment · Fixed by #1431
Assignees
@tenzen-y
Labels
kind/bug Categorizes issue or PR as related to a bug.

Comments

@astefanutti
Copy link
Member

What happened:

The following messages are repeatedly emitted in the operator logs:

W1208 15:30:36.007289       1 reflector.go:535] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: failed to list *v1beta3.PriorityLevelConfiguration: prioritylevelconfigurations.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:kueue-system:kueue-controller-manager" cannot list resource "prioritylevelconfigurations" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope
E1208 15:30:36.007354       1 reflector.go:147] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: Failed to watch *v1beta3.PriorityLevelConfiguration: failed to list *v1beta3.PriorityLevelConfiguration: prioritylevelconfigurations.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:kueue-system:kueue-controller-manager" cannot list resource "prioritylevelconfigurations" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope

W1208 15:30:40.237300       1 reflector.go:535] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: failed to list *v1beta3.FlowSchema: flowschemas.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:kueue-system:kueue-controller-manager" cannot list resource "flowschemas" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope
E1208 15:30:40.237370       1 reflector.go:147] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: Failed to watch *v1beta3.FlowSchema: failed to list *v1beta3.FlowSchema: flowschemas.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:kueue-system:kueue-controller-manager" cannot list resource "flowschemas" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope

How to reproduce it (as minimally and precisely as possible):

Install the Visibility API service and start the operator with --feature-gates=VisibilityOnDemand=true.

Anything else we need to know?:

APF is enabled by default when creating a generic API server. It could either be disabled, or the required RBAC be added.

Environment:

  • Kueue version (use git describe --tags --dirty --always): v0.5.0-devel-396-g6d428f3-dirty
@astefanutti astefanutti added the kind/bug Categorizes issue or PR as related to a bug. label Dec 8, 2023
@tenzen-y
Copy link
Member

tenzen-y commented Dec 8, 2023

Thank you for creating this! I also faced this issue in #1422. Then I was thinking of creating similar to this issue :)

/assign

@tenzen-y tenzen-y mentioned this issue Dec 8, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tenzen-y tenzen-y

Labels
kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add RBAC for the flowcontrol.apiserver.k8s.io tenzen-y/kueue
2 participants
@astefanutti @tenzen-y