You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/content/en/docs/building-operators/golang/references/client.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -82,7 +82,7 @@ Creating a new Client is not usually necessary nor advised, as the default Clien
82
82
83
83
### Reconcile and the Client API
84
84
85
-
A Reconciler implements the [`reconcile.Reconciler`][doc-reconcile-reconciler] interface, which exposes the Reconcile method. Reconcilers are added to a corresponding Controller for a Kind; Reconcile is called in response to cluster or external Events, with a `reconcile.Request` object argument, to read and write cluster state by the Controller, and returns a `reconcile.Result`. SDK Reconcilers have access to a Client in order to make Kubernetes API calls.
85
+
A Reconciler implements the [`reconcile.Reconciler`][doc-reconcile-reconciler] interface, which exposes the Reconcile method. Reconcilers are added to a corresponding Controller for a Kind; Reconcile is called in response to cluster or external Events, with a `reconcile.Request` object argument, to read and write cluster state by the Controller, and returns a `ctrl.Result`. SDK Reconcilers have access to a Client in order to make Kubernetes API calls.
86
86
87
87
```Go
88
88
// KindReconciler reconciles a Kind object
@@ -106,7 +106,7 @@ type KindReconciler struct {
106
106
// The Controller will requeue the Request to be processed again if an error
107
107
// is non-nil or Result.Requeue is true, otherwise upon completion it will
Reconcile is where Controller business logic lives, i.e. where Client API calls are made via `KindReconciler.client`. A `client.Client` implementer performs the following operations:
Copy file name to clipboardExpand all lines: website/content/en/docs/faqs/_index.md
+35-42Lines changed: 35 additions & 42 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,88 +33,81 @@ For more information on `kube-apiserver` request timeout options, see the [Kuber
33
33
34
34
Unfortunately, adding the entire dependency tree for all Ansible modules would be excessive. Fortunately, you can add it easily. Simply edit your build/Dockerfile. You'll want to change to root for the install command, just be sure to swap back using a series of commands like the following right after the `FROM` line.
35
35
36
-
```
36
+
```docker
37
37
USER 0
38
38
RUN yum -y install my-dependency
39
39
RUN pip3 install my-python-dependency
40
40
USER 1001
41
41
```
42
42
43
-
If you aren't sure what dependencies are required, start up a container using the image in the `FROM` line as root. That will look something like this.
44
-
`docker run -u 0 -it --rm --entrypoint /bin/bash quay.io/operator-framework/ansible-operator:<sdk-tag-version>`
43
+
If you aren't sure what dependencies are required, start up a container using the image in the `FROM` line as root. That will look something like this:
44
+
```sh
45
+
docker run -u 0 -it --rm --entrypoint /bin/bash quay.io/operator-framework/ansible-operator:<sdk-tag-version>
46
+
```
45
47
46
48
## I keep seeing errors like "Failed to watch", how do I fix this?
47
49
48
-
If you run into the following error message, it means that your operator is unable to watch the resoruce:
50
+
If you run into the following error message, it means that your operator is unable to watch the resource:
{"level":"info","ts":1584718937.766342,"logger":"controller_memcached","msg":"ImageStreamTag resource not found.
53
55
```
54
56
55
-
Using controller-runtime's split client means that read operations (gets and lists) are read from a cache, and write operations are written directly to the API server. To populate the cache for reads, controller-runtime initiates a `list` and then a `watch` even when your operator is only attempting to `get` a single resource. The above scenario occurs when the operator does not have an (RBAC)[rbac] permission to `watch` the resource. The solution is to grant permission in the `config/rbac/role.yaml`file.
57
+
Using controller-runtime's split client means that read operations (gets and lists) are read from a cache, and write operations are written directly to the API server. To populate the cache for reads, controller-runtime initiates a `list` and then a `watch` even when your operator is only attempting to `get` a single resource. The above scenario occurs when the operator does not have an [RBAC][rbac] permission to `watch` the resource. The solution is to add an RBAC directive to generate a `config/rbac/role.yaml`with `watch` privileges:
56
58
57
-
In rare cases, it also could be that the particular resource does not implement the `watch` verb. In this case, it is necessary to use the [client.Reader][client.Reader] instead of the default split client. The manager's `GetAPIReader()` function can be used to get this reader.
Here is an example that demonstrates how to use a `client.Reader` when a resource does not implement the `watch` verb:
63
+
Alternatively, if the resource you're attempting to cannot be watched (like `v1.ImageStreamTag` above), you can specify that objects of this type should not be cached by adding the following to `main.go`:
62
64
63
65
```go
64
-
65
66
import (
66
67
...
67
68
imagev1 "github.com/openshift/api/image/v1"
68
69
)
69
70
70
-
...
71
-
72
-
// newReconciler returns a new reconcile.Reconciler
Now run `make manifests` to update your `role.yaml`.
97
+
98
+
105
99
## I keep hitting errors like "is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on:", how do I fix this?
106
100
107
101
If you are facing this issue, it means that the operator is missing the required RBAC permissions to update finalizers on the APIs it manages. This permission is necessary if the [OwnerReferencesPermissionEnforcement][owner-references-permission-enforcement] plugin is enabled in your cluster.
108
102
109
-
For Helm and Ansible operators, this permission is configured by default. However for Go operators, it may be necessary to add this permission yourself.
110
-
111
-
In Go operators, RBAC permissions are configured via [RBAC markers][rbac-markers], which are used to generate and update the manifest files present in `config/rbac/`. Add the following marker line on your controller's `Reconcile()` method:
103
+
For Helm and Ansible operators, this permission is configured by default. However for Go operators, it may be necessary to add this permission yourself
104
+
by adding an RBAC directive to generate a `config/rbac/role.yaml` with `update` privileges on your CR's finalizers:
0 commit comments