Flink Kubernetes operator 1 3 0 with watch namespace on ope Apache Flink #troubleshooting

[Flink Kubernetes operator 1.3.0] with watch names...

kingsathurthi

01/25/2023, 12:16 PM

[Flink Kubernetes operator 1.3.0] with watch namespace on openshift when deploying flinkdeployment im getting below error

Error: container has runAsNonRoot and image has non-numeric user (flink), cannot verify user is non-root (pod: "podname-66bfdf99f6-s6pzr_welk-tx02-vzw-anpd-y-nk-inf-020(3a796c2e-f11b-4de2-8a09-eab801cde6d4)", container: conainer_name)

flink kubernetes operator has belwo security context enabled

podSecurityContext:

runAsUser: 9999

runAsGroup: 9999

runAsNonRoot: true

fsGroup: 9999

sharing pointer will be helpful

Bhupendra Yadav

01/25/2023, 5:16 PM

Try adding security context in container spec

kingsathurthi

01/27/2023, 12:08 PM

thanks, did the same it worked

Rajat Ahuja

07/11/2023, 4:34 AM

so when i run the job after login into the job manager ( setup session cluster on k8s via oeprator )getting this error The program finished with the following exception: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.43.0.1/api/v1/namespaces/apl-edm-streaming-svcs-l3-dev1/services/session-six-try-deployment-only-example-rest. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. services "session-six-try-deployment-only-example-rest" is forbidden: User "systemserviceaccountapl-edm-streaming-svcs-l3-dev1:flink" cannot get resource "services" in API group "" in the namespace "apl-edm-streaming-svcs-l3-dev1". at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:684) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:664) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:613) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:558) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:521) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleGet(OperationSupport.java:490) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleGet(OperationSupport.java:460) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleGet(BaseOperation.java:698) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.getMandatory(BaseOperation.java:184) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.get(BaseOperation.java:151) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.get(BaseOperation.java:83) at org.apache.flink.kubernetes.kubeclient.Fabric8FlinkKubeClient.getService(Fabric8FlinkKubeClient.java:216) at org.apache.flink.kubernetes.kubeclient.Fabric8FlinkKubeClient.getRestEndpoint(Fabric8FlinkKubeClient.java:178) at org.apache.flink.kubernetes.KubernetesClusterDescriptor.lambda$createClusterClientProvider$1(KubernetesClusterDescriptor.java:99) at org.apache.flink.kubernetes.KubernetesClusterDescriptor.retrieve(KubernetesClusterDescriptor.java:148) at org.apache.flink.kubernetes.KubernetesClusterDescriptor.retrieve(KubernetesClusterDescriptor.java:69) at org.apache.flink.client.cli.CliFrontend.runClusterAction(CliFrontend.java:1032) at org.apache.flink.client.cli.CliFrontend.list(CliFrontend.java:423) at org.apache.flink.client.cli.CliFrontend.parseAndRun(CliFrontend.java:1093) at org.apache.flink.client.cli.CliFrontend.lambda$main$10(CliFrontend.java:1165) at org.apache.flink.runtime.security.contexts.NoOpSecurityContext.runSecured(NoOpSecurityContext.java:28) at org.apache.flink.client.cli.CliFrontend.main(CliFrontend.java:1165) ./bin/flink run --detached ./examples/streaming/StateMachineExample.jar

Rajat Ahuja

07/11/2023, 4:35 AM

Cluster set up

Copy code

apiVersion: <http://flink.apache.org/v1beta1|flink.apache.org/v1beta1>
kind: FlinkDeployment
metadata:
  name: session-six-try-deployment-only-example
spec:
  image: flink:1.16
  flinkVersion: v1_16
  flinkConfiguration:
    taskmanager.numberOfTaskSlots: "10"
    rest.server.max-content-length: "1209715200"
    rest.client.max-content-length: "1209715200"
  serviceAccount: flink
  jobManager:
    resource:
      memory: "2048m"
      cpu: 1
  taskManager:
    resource:
      memory: "2048m"
      cpu: 1

@Bhupendra Yadav do you think i need to set up correct user ?

Bhupendra Yadav

07/11/2023, 4:38 AM

As the error says your service account doesn't have access to get services in your namespace. Male sure you have appropriate role and role binding attached to your service account for access

Bhupendra Yadav

07/11/2023, 4:39 AM

You can refer https://github.com/apache/flink-kubernetes-operator/blob/main/helm/flink-kubernetes-operator/templates/rbac.yaml

Rajat Ahuja

07/11/2023, 4:55 AM

@Bhupendra Yadav thanks is there any example ?

Open in Slack

Previous Next