Deprecates our own statefulset pod label kafka-broker-id

Yolean · Dec 14, 2017 · 096e3bd · 096e3bd
1 parent af7990e
commit 096e3bd
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -68,6 +68,8 @@ For clusters that enfoce [RBAC](https://kubernetes.io/docs/admin/authorization/r
 kubectl apply -f rbac-namespace-default/
 ```
 
+For example rack awareness can fail without this, `logs -c init-config` showing `Error from server (Forbidden): pods "kafka-0" is forbidden: User "system:serviceaccount:kafka:default" cannot get pods in the namespace "kafka": Unknown user "system:serviceaccount:kafka:default"`.
+
 ## Tests
 
 Tests are based on the [kube-test](https://github.com/Yolean/kube-test) concept.

diff --git a/kafka/10broker-config.yml b/kafka/10broker-config.yml
@@ -23,6 +23,7 @@ data:
         sed -i "s/#init#broker.rack=#init#/broker.rack=$ZONE/" /etc/kafka/server.properties
       fi
 
+      # This requires additional RBAC, and won't be needed after https://github.com/kubernetes/kubernetes/pull/55329
       kubectl -n $POD_NAMESPACE label pod $POD_NAME kafka-broker-id=$KAFKA_BROKER_ID
 
       OUTSIDE_HOST=$(kubectl get node "$NODE_NAME" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')