Getting a lot of exceptions when creating a custom resource

[heruan]

I have defined a custom resource App and a reconciler for it:

@ControllerConfiguration(namespaces = Constants.WATCH_CURRENT_NAMESPACE)
public class AppController implements Reconciler<App>, EventSourceInitializer<App> {

    private final Workflow<App> workflow;

    public AppController(OperatorProperties properties) {
        this.workflow = new WorkflowBuilder<>()
                .addDependentResource(new AppServiceAccount(properties))
                .addDependentResource(new AppRole(properties))
                .addDependentResource(new AppRoleBinding(properties))
                .addDependentResource(new AppDeployment(properties))
                .addDependentResource(new AppConfigMap(properties))
                .addDependentResource(new AppService(properties))
                .addDependentResource(new AppIngress(properties))
                .build();
    }

    @Override
    public Map<String, EventSource> prepareEventSources(EventSourceContext<App> context) {
        return EventSourceInitializer.eventSourcesFromWorkflow(context, workflow);
    }

    @Override
    public UpdateControl<App> reconcile(App app, Context<App> context) {
        workflow.reconcile(app, context);
        return UpdateControl.noUpdate()
    }
}

When I deploy a new App all resources are created correctly, but I get a lot of exceptions like this for dependent resources:

Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://10.96.0.1:443/apis/rbac.authorization.k8s.io/v1/namespaces/dev/rolebindings/my-app?fieldManager=appcontroller&force=true. Message: roles.rbac.authorization.k8s.io "my-app" not
 found. Received status: Status(apiVersion=v1, code=404, details=StatusDetails(causes=[], group=rbac.authorization.k8s.io, kind=roles, name=my-app, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=roles.rbac.authorization.k8s.io "my-app" not found, metadata=ListMeta(_continue=null, rem
ainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=NotFound, status=Failure, additionalProperties={}).
...
     at io.javaoperatorsdk.operator.processing.dependent.workflow.WorkflowResult.throwAggregateExceptionIfErrorsPresent(WorkflowResult.java:54) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.dependent.workflow.WorkflowReconcileResult.throwAggregateExceptionIfErrorsPresent(WorkflowReconcileResult.java:9) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.dependent.workflow.DefaultWorkflow.reconcile(DefaultWorkflow.java:95) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:148) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:111) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.api.monitoring.Metrics.timeControllerExecution(Metrics.java:219) ~[operator-framework-core-4.9.5.jar!/:na]
     at io.javaoperatorsdk.operator.processing.Controller.reconcile(Controller.java:110) ~[operator-framework-core-4.9.5.jar!/:na]

Is this some sort of expected timing issue, or what am I missing to avoid those exceptions?

[metacosm]

It's difficult to tell just from this context but it might indeed be a timing issue, where some of your dependents might require the RoleBinding to be created before they can be reconciled. In that situation, you can create your workflow in such a way that the dependents that depend on the RoleBinding being present won't be reconciled until the RoleBinding exists either via a "depends on" relationship or a reconcile precondition on the dependents that require the RoleBinding to be reconciled. See https://javaoperatorsdk.io/docs/workflows/#elements-of-workflow for more details.

[heruan]

Creating the workflow with dependencies seems to have fixed the issue, thanks!

    Workflow<App> appWorkflow(OperatorProperties properties) {
        var serviceAccount = new AppServiceAccount(properties);
        var role = new AppRole(properties);
        var roleBinding = new AppRoleBinding(properties);
        var deployment = new AppDeployment(properties);
        var configMap = new AppConfigMap(properties);
        var service = new AppService(properties);
        var ingress = new AppIngress(properties);
        // @formatter:off
        return new WorkflowBuilder<App>()
                .addDependentResource(serviceAccount)
                .addDependentResource(role)
                .addDependentResource(roleBinding)
                    .dependsOn(role, serviceAccount)
                .addDependentResource(configMap)
                .addDependentResource(deployment)
                    .dependsOn(serviceAccount)
                .addDependentResource(service)
                    .dependsOn(deployment)
                .addDependentResource(ingress)
                    .dependsOn(service)
                    .withReconcilePrecondition(new AppIngressCondition())
                .build();
        // @formatter:on
    }

[csviri]

@heruan what version of the framework are you using? This should not happen with newer version which use SSA.

If you could create a reproducer we can take a look.

[heruan]

I'm using 4.9.5 that comes with the latest JOSDK Spring Boot starter 5.6.0. What is SSA? Explicitly setting dependencies in the workflow seems to have fixed the issue.

[csviri]

Ok, that it should be ok, there are other reasons where we saw this failing. Ordering is one of them. SSA is Server Side Apply.
thx!