I'm trying out resque-kubernetes on a K8S cluster run by a university with multiple groups and tenants operating within the cluster. As a result, my application only has namespace-scope ability to list jobs and pods. Using the gem in this cluster produces an error like: HTTP status code 403, jobs.batch is forbidden: User "[...]" cannot list resource "jobs" in API group "batch" at the cluster scope for GET https://kubernetes.default.svc/apis/batch/v1/jobs. Tracing the error back, it looks like it's caused by kubeclient get_jobs and get_pods calls like
|
resque_jobs = jobs_client.get_jobs({label_selector: "resque-kubernetes=job"}) |
that don't have any way of taking a namespace option, so they by default shoot for cluster scope. And it's not a general configuration problem, because if I instead use
jobs_client.get_jobs(namespace: 'my-namespace'), it works just fine.
Is there a way to get resque-kubernetes to stick to a specific namespace for all its API interactions? I looked at the kubeclient docs to see if there was some way to initialize it with a namespace, but all I saw were ways to limit by namespace at the point of calling get_jobs, etc. If I'm missing something, I'll be happy to learn that. Thanks!
I'm trying out resque-kubernetes on a K8S cluster run by a university with multiple groups and tenants operating within the cluster. As a result, my application only has namespace-scope ability to list jobs and pods. Using the gem in this cluster produces an error like:
HTTP status code 403, jobs.batch is forbidden: User "[...]" cannot list resource "jobs" in API group "batch" at the cluster scope for GET https://kubernetes.default.svc/apis/batch/v1/jobs. Tracing the error back, it looks like it's caused by kubeclientget_jobsandget_podscalls likeresque-kubernetes/lib/resque/kubernetes/jobs_manager.rb
Line 77 in 9ff6c40
jobs_client.get_jobs(namespace: 'my-namespace'), it works just fine.Is there a way to get resque-kubernetes to stick to a specific namespace for all its API interactions? I looked at the kubeclient docs to see if there was some way to initialize it with a namespace, but all I saw were ways to limit by namespace at the point of calling
get_jobs, etc. If I'm missing something, I'll be happy to learn that. Thanks!