Message: Forbidden!Configured service account doesn't have access.

[develmac]

So I am trying to run strimzi on K3S cluster running on RBPI 4s.

I got the images all compiled using the master branch, but when I deploy them (I have tried the yaml and the helm approach) I get the following error from the operator when deploying Kafka:

ERROR AbstractOperator:276 - Reconciliation #5(timer) Kafka(kafka/my-cluster): createOrUpdate failed
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.43.0.1/apis/networking.k8s.io/v1/namespaces/kafka/ingresses?labelSelector=strimzi.io%2Fcluster%3Dmy-cluster%2C
strimzi.io%2Fname%3Dmy-cluster-kafka%2Cstrimzi.io%2Fkind%3DKafka. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. ingresses.networking.k8s.io is for
bidden: User "system:serviceaccount:kafka:strimzi-cluster-operator" cannot list resource "ingresses" in API group "networking.k8s.io" in the namespace "kafka".

Can anybody give me a hint whether this is due to my K3S Version (I think they made RBAC stricter?) or because of the custom images?

THX!

[scholzj]

I think you installed it using old installation files. Please make sure to use the RBAC files from packaging/install/cluster-operator from latest master ... I think they should fix this problem.

[develmac]

Thx for the quick reply! Is it normal to see: W0316 00:08:17.254342 6489 warnings.go:70] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition

While installing the Helm chart?

[scholzj]

Yeah, that is normal. We will support CRD apiextensions/v1 in Strimzi 0.23

[develmac]

Thank you for the support, it worked with the proper installation files :) It was a bit confusing of having two of them in the project.

[develmac]

In any case, Strimzi runs great on a cluster of a few raspberry 4s :)