Move Initial RBAC Reconcile Attempt
The first RBAC reconciliation is now attempted when a controller group is
first created, immediately giving the Operator an opportunity to create
it's own RBAC within a target namespace if it has the ability to do so,
e.g. when using the "dynamic" namespace operating mode
@@ -369,6 +369,27 @@ func (c *ControllerManager) addControllerGroup(namespace string) error {
log.Debugf("Controller Manager: added controller group for namespace %s", namespace)
+ // check if we can create RBAC in the namespace in order to the reconcile RBAC
+ // as needed to ensure proper operator functionality. If we can't reconcile at this point
+ // we will try again on the next namespace refresh interval.
+ canCreateRBACInNamespace, err := ns.CanCreateRBACInNamespace(
+ c.controllers[namespace].kubeClientset,
+ namespace, c.namespaceOperatingMode)
+ if err != nil {
+ return err
+ }
+
+ log.Debugf("Controller Manager: canCreateRBACInNamespace is '%t' for namespace %s",
+ canCreateRBACInNamespace, namespace)
+
+ // now reconcile RBAC in the namespace if allowed
+ if canCreateRBACInNamespace {
+ if err := ns.ReconcileTargetRBAC(c.controllers[namespace].kubeClientset, c.pgoNamespace,
+ namespace); err != nil {
+ return err
+ }
+ }
+
return nil
}
@@ -481,26 +502,6 @@ func (c *ControllerManager) runControllerGroup(namespace string) error {
"refresh interval", namespace)
}
- // check if we can create RBAC in the namespace in order to the reconcile RBAC
- // as needed to ensure proper operator functionality
- canCreateRBACInNamespace, err := ns.CanCreateRBACInNamespace(
- c.controllers[namespace].kubeClientset,
- namespace, c.namespaceOperatingMode)
- if err != nil {
- return err
- }
-
- log.Debugf("Controller Manager: canCreateRBACInNamespace is '%t' for namespace %s",
- canCreateRBACInNamespace, namespace)
-
- // now reconcile RBAC in the namespace if allowed
- if canCreateRBACInNamespace {
- if err := ns.ReconcileTargetRBAC(c.controllers[namespace].kubeClientset, c.pgoNamespace,
- namespace); err != nil {
- return err
- }
- }
-
controllerGroup.kubeInformerFactory.Start(controllerGroup.stopCh)
controllerGroup.pgoInformerFactory.Start(controllerGroup.stopCh)
controllerGroup.kubeInformerFactoryWithRefresh.Start(controllerGroup.stopCh)
