Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
Discussion options

I have defined a custom resource App and a reconciler for it:

@ControllerConfiguration(namespaces = Constants.WATCH_CURRENT_NAMESPACE)
public class AppController implements Reconciler<App>, EventSourceInitializer<App> {

    private final Workflow<App> workflow;

    public AppController(OperatorProperties properties) {
        this.workflow = new WorkflowBuilder<>()
                .addDependentResource(new AppServiceAccount(properties))
                .addDependentResource(new AppRole(properties))
                .addDependentResource(new AppRoleBinding(properties))
                .addDependentResource(new AppDeployment(properties))
                .addDependentResource(new AppConfigMap(properties))
                .addDependentResource(new AppService(properties))
                .addDependentResource(new AppIngress(properties))
                .build();
    }

    @Override
    public Map<String, EventSource> prepareEventSources(EventSourceContext<App> context) {
        return EventSourceInitializer.eventSourcesFromWorkflow(context, workflow);
    }

    @Override
    public UpdateControl<App> reconcile(App app, Context<App> context) {
        workflow.reconcile(app, context);
        return UpdateControl.noUpdate()
    }
}

When I deploy a new App all resources are created correctly, but I get a lot of exceptions like this for dependent resources:

Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://10.96.0.1:443/apis/rbac.authorization.k8s.io/v1/namespaces/dev/rolebindings/my-app?fieldManager=appcontroller&force=true. Message: roles.rbac.authorization.k8s.io "my-app" not
 found. Received status: Status(apiVersion=v1, code=404, details=StatusDetails(causes=[], group=rbac.authorization.k8s.io, kind=roles, name=my-app, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=roles.rbac.authorization.k8s.io "my-app" not found, metadata=ListMeta(_continue=null, rem
ainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=NotFound, status=Failure, additionalProperties={}).
...
     at io.javaoperatorsdk.operator.processing.dependent.workflow.WorkflowResult.throwAggregateExceptionIfErrorsPresent(WorkflowResult.java:54) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.dependent.workflow.WorkflowReconcileResult.throwAggregateExceptionIfErrorsPresent(WorkflowReconcileResult.java:9) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.dependent.workflow.DefaultWorkflow.reconcile(DefaultWorkflow.java:95) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:148) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:111) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.api.monitoring.Metrics.timeControllerExecution(Metrics.java:219) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.Controller.reconcile(Controller.java:110) ~[operator-framework-core-4.9.5.jar!/:na]

Is this some sort of expected timing issue, or what am I missing to avoid those exceptions?

You must be logged in to vote

It's difficult to tell just from this context but it might indeed be a timing issue, where some of your dependents might require the RoleBinding to be created before they can be reconciled. In that situation, you can create your workflow in such a way that the dependents that depend on the RoleBinding being present won't be reconciled until the RoleBinding exists either via a "depends on" relationship or a reconcile precondition on the dependents that require the RoleBinding to be reconciled. See https://javaoperatorsdk.io/docs/workflows/#elements-of-workflow for more details.

Replies: 2 comments · 3 replies

Comment options

It's difficult to tell just from this context but it might indeed be a timing issue, where some of your dependents might require the RoleBinding to be created before they can be reconciled. In that situation, you can create your workflow in such a way that the dependents that depend on the RoleBinding being present won't be reconciled until the RoleBinding exists either via a "depends on" relationship or a reconcile precondition on the dependents that require the RoleBinding to be reconciled. See https://javaoperatorsdk.io/docs/workflows/#elements-of-workflow for more details.

You must be logged in to vote
1 reply
@heruan
Comment options

Creating the workflow with dependencies seems to have fixed the issue, thanks!

    Workflow<App> appWorkflow(OperatorProperties properties) {
        var serviceAccount = new AppServiceAccount(properties);
        var role = new AppRole(properties);
        var roleBinding = new AppRoleBinding(properties);
        var deployment = new AppDeployment(properties);
        var configMap = new AppConfigMap(properties);
        var service = new AppService(properties);
        var ingress = new AppIngress(properties);
        // @formatter:off
        return new WorkflowBuilder<App>()
                .addDependentResource(serviceAccount)
                .addDependentResource(role)
                .addDependentResource(roleBinding)
                    .dependsOn(role, serviceAccount)
                .addDependentResource(configMap)
                .addDependentResource(deployment)
                    .dependsOn(serviceAccount)
                .addDependentResource(service)
                    .dependsOn(deployment)
                .addDependentResource(ingress)
                    .dependsOn(service)
                    .withReconcilePrecondition(new AppIngressCondition())
                .build();
        // @formatter:on
    }
Answer selected by heruan
Comment options

@heruan what version of the framework are you using? This should not happen with newer version which use SSA.

If you could create a reproducer we can take a look.

You must be logged in to vote
2 replies
@heruan
Comment options

I'm using 4.9.5 that comes with the latest JOSDK Spring Boot starter 5.6.0. What is SSA? Explicitly setting dependencies in the workflow seems to have fixed the issue.

@csviri
Comment options

Ok, that it should be ok, there are other reasons where we saw this failing. Ordering is one of them. SSA is Server Side Apply.
thx!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
🙏
Q&A
Labels
None yet
3 participants
Morty Proxy This is a proxified and sanitized view of the page, visit original site.