Single Namespace mode looks broken

Marek · May 6, 2021, 1:31pm

Hey,

I’m trying to run Astronomer in single namespace mode. But it is failing with:
Error: Role.rbac.authorization.k8s.io "xxx" is invalid: rules[32].nonResourceURLs: Invalid value: []string{"/metrics"}: namespaced rules cannot apply to non-resource URLs

Looks like the reason for lies in helm commander template for role:

github.com

astronomer/astronomer/blob/master/charts/astronomer/templates/commander/commander-role.yaml#L112


  verbs: ["update"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "create", "delete", "patch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses/status"]
  verbs: ["update"]
- apiGroups: ["networking.k8s.io"]
  resources: ["networkpolicies"]
  verbs: ["create", "delete", "get", "patch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings"]
  verbs: ["create", "delete", "get", "patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings"]
  verbs: ["create", "delete", "get", "patch"]
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["create", "delete"]

It is defining nonResourceURLs for Role object and it is allowed only for ClusterRole. Can this be checked?

Marek · May 7, 2021, 7:38am

I’ve tried new deployment without this problematic rule and everything seems to work apart of Celery deployment. Deployment process for Celery type is not even starting (it’s gray in UI). Kubernetes and Local ones are working fine.

paola · May 10, 2021, 5:39pm

Hey @Marek! I’m sorry to hear you’re running into trouble with the Astronomer platform, though namespace mode is something our team typically does not support.

For this scenario, I’d recommend you stay in close touch with your primary point of contact at Astronomer - they’ll be best fit to point you in the right direction of our support, product, and engineering resources as you get up and running. You can expect an outreach from our team today on this

Topic		Replies	Views
Astronomer software - one k8s namespace for all airflow workspaces/deployments Astronomer astro-sdk	3	1285	April 24, 2023
Can I integrate IAM roles with Astronomer? Astronomer Software (Enterprise)	1	3065	June 16, 2020
K8SPodOperator Guide Inaccurate/Incomplete? Astronomer kubernetes	4	1313	March 7, 2024
When do i need to run multiple Astronomers? Astronomer Software (Enterprise)	1	1948	May 12, 2020
Docker push failure Astronomer Nebula	3	2444	February 16, 2021

Single Namespace mode looks broken

Related topics