Forbidden!Configured service account doesn't have access

[sudhim076]

Hi Team -
I have deployed the quickstart into our AKS cluster.
Cluster operator deployment was successful and I can see al the CRDs, roles, role bindings etc.
Then I deployed the cluster kafka-persistent-single.yaml and I got the success message as below:
kafka.kafka.strimzi.io/my-cluster created

But, I can't see the cluster is running and when checked the operator logs I see below: Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://192.168.0.1:443/apis/policy/v1/namespaces/kafka/poddisruptionbudgets. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. admission webhook "validation.gatekeeper.sh" denied the request: [pod-distruption-budget] All Pod Disruption Budgets must have an .spec.maxUnavailable configured.

Could you please help.

[scholzj]

This is a bit confusing without knowing what exact steps you did and seeing the full log. From the error, I guess you have 3rd party tools (Gatekeeper) which block some of the API calls So you will need to address that somehow.

[sudhim076]

strimzi-cluster-operator.log
Thanks for the response.
Attached the logs.
Only steps I did are to execute below commands in the kafka namespace of my cluster.

1. kubectl create -f 'https://strimzi.io/install/latest?namespace=kafka' -n kafka
2. kubectl apply -f https://strimzi.io/examples/latest/kafka/kafka-persistent-single.yaml -n kafka

[scholzj]

Yeah, from the log it looks like you have some tooling in your cluster which is blocking the operator from creating the PodDisruptionBudget. It complains that it needs to have .spec.maxUnavailable. But Strimzi cannot use maxUnavailable because of https://kubernetes.io/docs/tasks/run-application/configure-pdb/#arbitrary-controllers-and-selectors -> so we use minAvailable. So you will need to have this tooling adjusted to support it.

[sudhim076]

Thank you. I will check with our internal team if we can adjust the gatekeeper policy.

Thanks again!!!