I'm running Apache Flink in Standalone Kubernetes (sesion) mode without Job Manager HA. But I need to deploy Job Manager HA, because only in HA mode, Flink can be persistent (can save job's after job manager restart). Flink runs in dedicated kubernetes namespace, and I have permissions only to namespace.
HA are enabled using this article: https://ci.apache.org/projects/flink/flink-docs-master/docs/deployment/ha/kubernetes_ha/
and I use yaml files from this article: https://ci.apache.org/projects/flink/flink-docs-master/docs/deployment/resource-providers/standalone/kubernetes/#kubernetes-high-availability-services
I have for example k28s namespace named flink-namespace. In this namespace I've created:
- serviceAccount named flink-sa
- role witch permissions to create/edit Configmaps in this namespace
so this serviceAccount has permissions to create/editr configmaps, but only in this namespace.
After deployment, jobManager can't start and throws error:
Caused by: io.fabric8.kubernetes.client.KubernetesClientException: configmaps "flink-restserver-leader" is forbidden: User "system:serviceaccount:flink-namespace:flink-sa" cannot watch resource "configmaps" in API group "" in the namespace "default"
With mean that serviceAccount with Flink are using to manage Configmaps, try to create Configmap in namespace "default" not in namespace "flink-namespace"
Does anybody know how to config flink to manage configmaps in specified namespace ?