Skip to main content
Version: Operator 2.4.0

Re-grant RBAC privileges to namespaces

OLM-based installations ( and RedHat OpenShift) have a known issue with upgrading from version 2.3.0 to 2.4.0. This upgrade scenario revokes the RBAC privileges required to run Aerospike clusters in Kubernetes namespaces other than the aerospike namespace.

Re-grant the RBAC privileges for each Kubernetes namespace (except aerospike) which contains Aerospike clusters.

The procedure to re-grant privileges to a Kubernetes namespace ns1 is as follows. Replace ns1 with the name of your namespace.

Create a service account

kubectl -n ns1 create serviceaccount aerospike-operator-controller-manager

If the service account already exists, ignore the error you receive.

Update the operator's ClusterRoleBinding

Next, add this service account to the Operator's ClusterRoleBinding.

kubectl edit $(kubectl get  | grep aerospike-kubernetes-operator | grep -v -- "-opera-" | grep -v -- "default-ns" | cut -f 1 -d " ")

This command launches an editor. Append the following lines to the subjects section:

  # A new entry for ns1.
# Replace ns1 with your namespace
- kind: ServiceAccount
name: aerospike-operator-controller-manager
namespace: ns1

Save and ensure that the changes are applied.

Here is a full example of the Operator's ClusterRoleBinding targeting the ns1 namespace.

kind: ClusterRoleBinding
creationTimestamp: "2022-06-16T10:48:36Z"
olm.owner: aerospike-kubernetes-operator.v2.4.0
olm.owner.kind: ClusterServiceVersion
olm.owner.namespace: test ""
name: aerospike-kubernetes-operator.v2.4.0-74b946466d
resourceVersion: "51841234"
uid: be546dd5-b21e-4cc3-8a07-e2fe5fe5274c
kind: ClusterRole
name: aerospike-kubernetes-operator.v2.4.0-74b946466d
- kind: ServiceAccount
name: aerospike-operator-controller-manager
namespace: operators

# New entry
- kind: ServiceAccount
name: aerospike-operator-controller-manager
namespace: ns1