[Bug]: Error when I try to re-deploy chart

[liviodonnini]

Bug Description

I'm using the strimzi-kafka-operator chart (version 0.44.0), and when I redeployed it with:

rbac:
   create: true

I ran into the following issue:

`failed to install release: 3 errors occurred: * rolebindings.rbac.authorization.k8s.io "strimzi-cluster-operator" already exists * rolebindings.rbac.authorization.k8s.io "strimzi-cluster-operator-watched" already exists * rolebindings.rbac.authorization.k8s.io "strimzi-cluster-operator-entity-operator-delegation" already exists`

It looks like these RoleBindings are already in place from a previous deployment, and the conflict is stopping the installation. Any guidance on how to resolve this would be greatly appreciated!

Steps to reproduce

No response

Expected behavior

No response

Strimzi version

0.44.0

Kubernetes version

Kubernetes 1.30.2

Installation method

No response

Infrastructure

No response

Configuration files and logs

No response

Additional context

No response

[im-konge]

Hi, could you please provide exact steps that you did to reproduce it? The part you mentioned that you redeployed it with:

rbac:
   create: true

is by default configured in the values.yaml (thus I think that it's a default).

[scholzj]

@liviodonnini Why do you think it is a Strimzi bug?

It seems like you (or your Helm?) did not properly uninstall the previous installation, and that is causing some kind of conflict for Helm. I do not think this is something Strimzi can do anything about, among other things, because we do not know what really should be done. Are they some forgotten resources that should be overwritten? Are these actual resources belonging to some other installation that will break if it is overwritten? And so on.

[liviodonnini]

I downloaded the Strimzi Kafka Operator Helm chart from:

https://artifacthub.io/packages/helm/strimzi/strimzi-kafka-operator/0.42.0

After that, I navigated to the chart’s directory and ran the following command to install it:

helm install strimzi-kafka-operator . --values values.yaml

Later, I uninstalled the chart with:

helm uninstall strimzi-kafka-operator

After that, I updated the values.yaml file to define a namespace:

watchNamespaces:
  - default

However, when I tried to reinstall the Helm chart with the same command, I encountered this error:

Error: INSTALLATION FAILED: 3 errors occurred:
        * rolebindings.rbac.authorization.k8s.io "strimzi-cluster-operator" already exists
        * rolebindings.rbac.authorization.k8s.io "strimzi-cluster-operator-watched" already exists
        * rolebindings.rbac.authorization.k8s.io "strimzi-cluster-operator-entity-operator-delegation" already exists
It seems like the RoleBindings were not fully removed during the uninstallation, causing conflicts on reinstallation.

It seems that the RoleBindings were not completely removed during the uninstallation, which is now causing conflicts on reinstallation.
Is there a way to resolve this or fully clean up the resources left from the previous deployment?

[scholzj]

Well, what was in your values.yaml? I'm not a Helm expert (or even a user). But I would expect that you should call it with the same values to make sure it deletes all the resources as not every configuration has the same resources?

[katheris]

@liviodonnini did you check whether the RoleBindings were present before trying to install the chart? It's possible this error isn't caused by RoleBindings being left behind but instead by you specifying a value in watchNamespaces that matches the Release.Namespace value. See this comment in the Helm chart: https://github.com/strimzi/strimzi-kafka-operator/blob/main/helm-charts/helm3/strimzi-kafka-operator/values.yaml#L6

# If you set `watchNamespaces` to the same value as ``.Release.Namespace` (e.g. `helm ... --namespace $NAMESPACE`),
# the chart will fail because duplicate RoleBindings will be attempted to be created in the same namespace
watchNamespaces: []

[im-konge]

Triaged on 14.11.2024: @liviodonnini could you please have a look on the @katheris comment, if this is the case? Thanks.