I am trying to build a Kubernetes controller using the excellent Fabric8 Kubernetes client for Java (https://github.com/fabric8io/kubernetes-client). As of now I use the version 4.10.3.
For that purpose I am constructing a SharedIndexInformer to properly watch resources events emitted by the cluster. I will take pods as resources example here.
So the SharedIndexInformer is constructed following this piece of code:
SharedIndexInformer<Pod> sharedIndexInformer = kubernetesClient.informers().sharedIndexInformerFor(
objectClass,
objectClassList,
10 * 60 * 1000);
Following, lot of code to attach events handler, start the indexer, have a reconciliation loop and so on.
The indexer is working perfectly fine when started from my local machine, and I see all pods being listed. However, when I run it on a pod in my cluster (with RBAC properly defined), I see only the pods for the namespace where the pod is run on.
I checked explicitly in the pod that, using kubectl, the associated service account was capable to list all pods in the cluster, and not only in the current namespace.
What am I missing?
Thanks in advance for your help!
I think this is due to the difference between how
KubernetesClientcreates it'sConfigwhen outside Kubernetes Cluster or inside aPod. In the former case,KubernetesClientusually reads from your~/.kube/configand connection information like token and namespace are picked up from your current context in your~/.kube/configfile.However, when
KubernetesClientis inside a Pod; it picks up connectionConfiginformation from loadedServiceAccount, See Config.java. Bearer token gets picked from/var/run/secrets/kubernetes.io/serviceaccount/tokenand the default namespace to be used for namespaced API operations is picked from/var/run/secrets/kubernetes.io/serviceaccount/namespace. You can find more about it in Kubernetes Docs: Accessing API from a Pod. I thinkKubernetesClientis picking this namespace while loading theConfig.I think
KubernetesClientis not handling this case properly. This should be fixed there. There is already an issue filed there: https://github.com/fabric8io/kubernetes-client/issues/2514I'm not sure if right now informers can detect whether they are in-cluster or outside(This is only known till we load
Config). Right now, informers provide way to specify namespace usingOperationContext:Maybe for overriding this namespace being loaded from
ServiceAccountwe can allow settingnullnamespace:Update:
The underlying issue seems to be fixed in v4.13.0. I've tested this on this demo project: https://github.com/r0haaaan/fabric8-kubernetes-java-informer-in-pod . It runs SharedIndexInformers in a project and deploy to Kubernetes using Kubernetes Maven Plugin. When I check logs, I can see that all pods seem to be listed: