Description
I'm working with a controller that needs to synchronize resources between two different Kubernetes clusters. The controller runs in what we'll call the "spoke" cluster, but we want it to watch resources in another cluster, which we call the "hub." To handle the leader election inside the spoke cluster, we make the manager like this:
options := manager.Options{
...
LeaderElectionConfig: spokeCfg,
}
mgr, err := ctrl.NewManager(hubCfg, options)
This seems to work, and the configmap/lease that the leader election uses are on the spoke cluster. However, the leader election Events are going to the hub cluster.
We noticed this because we didn't give the kubeconfig on the hub cluster permissions to create events, so we get an error log like this (some details elided) :
E0208 21:45:38.523903 1 event.go:264] Server rejected event '&v1.Event{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ..., Reason:"LeaderElection", Message:"... became leader", ...}': 'events is forbidden: User "..." cannot create resource "events" in API group "" in the namespace "..."' (will not retry!)
I think the issue is that the recorderProvider
used here doesn't use the LeaderElectionConfig
:
controller-runtime/pkg/manager/manager.go
Lines 332 to 342 in 273e608