namespaced deployment reports list *v1.Namespace error

[fengxx]

Component(s)

collector

What happened?

Description

namespaced deployment reports list *v1.Namespace error

Steps to Reproduce

1. deploy operator with helm chart values extraArgs: ["--watch-namespace=foo-collector"]
2. deploy OpenTelemetryCollector in namespace foo-collector
3. logger showed "logger":"setup","message":"watching namespace(s)","namespaces":"foo-collector"}

suspect internal/webhook/podmutation/webhookhandler.go
https://github.com/open-telemetry/opentelemetry-operator/blob/main/internal/webhook/podmutation/webhookhandler.go#L67-L69
I think it is not necessay to invoke k8s client.Get for namespace, it should skip the test if p.config.WatchNamespace != ""

other mutatingwebhook like vault doesn't invoke k8s client at all, e.g. https://github.com/hashicorp/vault-k8s/blob/main/agent-inject/handler.go

Expected Result

it functions without error

Actual Result

collector reports error

"logger":"controller-runtime.cache.UnhandledError","message":"Failed to watch","reflector":"k8s.io/client-go@v0.35.4/tools/cache/reflector.go:289","type":"*v1.Namespace","error":"failed to list *v1.Namespace: namespaces is forbidden: User \"system:serviceaccount:foo-collector:otel-op\" cannot list resource \"namespaces\" in API group \"\" at the cluster scope","stacktrace":"k8s.io/apimachinery/pkg/util/runtime.logError\n\tk8s.io/apimachinery@v0.35.4/pkg/util/runtime/runtime.go:221\nk8s.io/apimachinery/pkg/util/runtime.handleError\n\tk8s.io/apimachinery@v0.35.4/pkg/util/runtime/runtime.go:212\nk8s.io/apimachinery/pkg/util/runtime.HandleErrorWithContext\n\tk8s.io/apimachinery@v0.35.4/pkg/util/runtime/runtime.go:198\nk8s.io/client-go/tools/cache.DefaultWatchErrorHandler\n\tk8s.io/client-go@v0.35.4/tools/cache/reflector.go:204\nk8s.io/client-go/tools/cache.(*Reflector).RunWithContext.func1\n\tk8s.io/client-go@v0.35.4/tools/cache/reflector.go:370\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:233\nk8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext.func1\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:255\nk8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:256\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:233\nk8s.io/client-go/tools/cache.(*Reflector).RunWithContext\n\tk8s.io/client-go@v0.35.4/tools/cache/reflector.go:368\nk8s.io/client-go/tools/cache.(*controller).RunWithContext.(*Group).StartWithContext.func3\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/wait.go:63\nk8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/wait.go:72"}

Kubernetes Version

1.34.6

Operator version

0.113.1

Collector version

0.151.0

Environment information

Environment

OS: (e.g., "Ubuntu 20.04")
Compiler(if manually compiled): (e.g., "go 14.2")

Log output

"logger":"controller-runtime.cache.UnhandledError","message":"Failed to watch","reflector":"k8s.io/client-go@v0.35.4/tools/cache/reflector.go:289","type":"*v1.Namespace","error":"failed to list *v1.Namespace: namespaces is forbidden: User \"system:serviceaccount:foo-collector:otel-op\" cannot list resource \"namespaces\" in API group \"\" at the cluster scope","stacktrace":"k8s.io/apimachinery/pkg/util/runtime.logError\n\tk8s.io/apimachinery@v0.35.4/pkg/util/runtime/runtime.go:221\nk8s.io/apimachinery/pkg/util/runtime.handleError\n\tk8s.io/apimachinery@v0.35.4/pkg/util/runtime/runtime.go:212\nk8s.io/apimachinery/pkg/util/runtime.HandleErrorWithContext\n\tk8s.io/apimachinery@v0.35.4/pkg/util/runtime/runtime.go:198\nk8s.io/client-go/tools/cache.DefaultWatchErrorHandler\n\tk8s.io/client-go@v0.35.4/tools/cache/reflector.go:204\nk8s.io/client-go/tools/cache.(*Reflector).RunWithContext.func1\n\tk8s.io/client-go@v0.35.4/tools/cache/reflector.go:370\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:233\nk8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext.func1\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:255\nk8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:256\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/backoff.go:233\nk8s.io/client-go/tools/cache.(*Reflector).RunWithContext\n\tk8s.io/client-go@v0.35.4/tools/cache/reflector.go:368\nk8s.io/client-go/tools/cache.(*controller).RunWithContext.(*Group).StartWithContext.func3\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/wait.go:63\nk8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1\n\tk8s.io/apimachinery@v0.35.4/pkg/util/wait/wait.go:72"}

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}