-
Bug
-
Resolution: Done
-
Normal
-
OSSM 2.6.12
-
None
-
False
-
-
False
-
Release Notes
-
Previously, when SMCP mode was changed from MultiTenant to ClusterWide, Kiali CR shows Failure status for a while. Now, it is not happening.
-
-
Kiali v1.73 is in an invalid state for a couple of seconds after switching from MultiTenant to ClusterWide.
There is an error in the kiali operator
```
deployment.cluster_wide_access must be enabled (i.e. 'true') when all namespaces are to be accessible (e.g. deployment.accessible_namespaces is undefined or has '**'). Aborting.
```
It is because the memberroll controller sets accessible_namespaces and api.namespaces.exclude according to the SMCP mode here: https://github.com/maistra/istio-operator/blob/maistra-2.6/pkg/controller/servicemesh/memberroll/controller.go#L377-L381
When a new SMCP is created, there is no issue:
- The Maistra operator generates the Kiali Custom Resource (CR) without cluster_wide_access set. (since it is not in kiali cr helm template)
- The memberroll controller populates accessible_namespaces.
- The addons.go logic then sets the cluster_wide_access field explicitly. This sequence does not cause issues.
However, a temporary invalid Kiali CR state can occur when an existing MultiTenant SMCP is updated to ClusterWide mode. In this scenario:
- The Kiali CR already exists with cluster_wide_access=false. (introduced by https://github.com/maistra/istio-operator/pull/1881 )
- When the memberroll controller updates accessible_namespaces to `*`, the Kiali CR becomes temporarily invalid from the Kiali operator's perspective. ( because contains accessible_namespaces=* as well as cluster_wide_access=false which is not allowed )
- This invalid state persists until the addons.go logic patches the Kiali CR to set cluster_wide_access=true.
Even though this error takes only couple of seconds, it would be fine to fix it to not have misleading errors in the kiali operator log.
Proposed fix:
Every time the memberroll controller sets accessible_namespaces="", it should set explicitly also cluster_wide_access=false
- is caused by
-
OSSM-11635 Kiali operator version 2.17.x does not create kiali-viewer Role and RoleBinding
-
- Closed
-