Why can't see jaeger collector and query after create a jaeger instance with jaeger-operator helm chart?

[seikyo-cho-lvgs]

I installed Jaeger Operator with helm chart as

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.1/cert-manager.yaml
helm install my-release jaegertracing/jaeger-operator -n observability

cat <<EOF | kubectl apply -f -
apiVersion: jaegertracing.io/v1
kind: Jaeger
metadata:
  name: simplest
EOF

But when I check the services, I can see nothing about jaeger.

kubectl get svc
(NULL)

However, if I installed Jaeger Operator from source:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.1/cert-manager.yaml
kubectl create -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.62.0/jaeger-operator.yaml -n observability

cat <<EOF | kubectl apply -f -
apiVersion: jaegertracing.io/v1
kind: Jaeger
metadata:
  name: simplest
EOF

I can see the jaeger collector and query:

kubectl get svc
NAME                            TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)                                                              AGE
simplest-collector              ClusterIP      10.43.109.221   <none>         9411/TCP,14250/TCP,14267/TCP,14268/TCP,14269/TCP,4317/TCP,4318/TCP   1h
simplest-collector-headless     ClusterIP      None            <none>         9411/TCP,14250/TCP,14267/TCP,14268/TCP,14269/TCP,4317/TCP,4318/TCP   1h
simplest-query                  ClusterIP      10.43.120.122   <none>         16686/TCP,16685/TCP,16687/TCP                                        1h

Why?

[iblancasa]

Hi. Can you check the Jaeger operator logs?

[seikyo-cho-lvgs]

@iblancasa

Thank you for your comment.

I checked the logs in Jaeger operator then I found the rbac.clusterRole configuration is false by default.
So just use this command to install will fail: $ helm install my-release jaegertracing/jaeger-operator -n observability.
Why don't set its default value to true?

Parameter	Description	Default
--	--	--
rbac.clusterRole	ClusterRole will be used by operator ServiceAccount	false
--	--	--

$ kubectl logs my-release-jaeger-operator-78c98b5c69-jbnsp -n observability
...
2024-12-17T05:52:03Z	INFO	could not get a list of namespaces, disabling namespace controller. reason: namespaces is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "namespaces" in API group "" at the cluster scope
2024-12-17T05:52:03Z	INFO	controller-runtime.builder	Registering a mutating webhook	{"GVK": "jaegertracing.io/v1, Kind=Jaeger", "path": "/mutate-jaegertracing-io-v1-jaeger"}
2024-12-17T05:52:03Z	INFO	controller-runtime.webhook	Registering webhook	{"path": "/mutate-jaegertracing-io-v1-jaeger"}
2024-12-17T05:52:03Z	INFO	controller-runtime.builder	Registering a validating webhook	{"GVK": "jaegertracing.io/v1, Kind=Jaeger", "path": "/validate-jaegertracing-io-v1-jaeger"}
2024-12-17T05:52:03Z	INFO	controller-runtime.webhook	Registering webhook	{"path": "/validate-jaegertracing-io-v1-jaeger"}
2024-12-17T05:52:03Z	INFO	controller-runtime.webhook	Registering webhook	{"path": "/mutate-v1-deployment"}
2024-12-17T05:52:03Z	INFO	controller-runtime.metrics	Starting metrics server
2024-12-17T05:52:03Z	INFO	controller-runtime.metrics	Serving metrics server	{"bindAddress": "0.0.0.0:8383", "secure": false}
2024-12-17T05:52:03Z	INFO	starting server	{"kind": "health probe", "addr": "[::]:8081"}
2024-12-17T05:52:03Z	INFO	controller-runtime.webhook	Starting webhook server
2024-12-17T05:52:03Z	INFO	controller-runtime.certwatcher	Updated current TLS certificate
2024-12-17T05:52:03Z	INFO	controller-runtime.webhook	Serving webhook server	{"host": "", "port": 9443}
2024-12-17T05:52:03Z	INFO	controller-runtime.certwatcher	Starting certificate watcher
W1217 05:52:03.959276       1 reflector.go:539] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: failed to list *v1.IngressClass: ingressclasses.networking.k8s.io is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "ingressclasses" in API group "networking.k8s.io" at the cluster scope
E1217 05:52:03.959319       1 reflector.go:147] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: Failed to watch *v1.IngressClass: failed to list *v1.IngressClass: ingressclasses.networking.k8s.io is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "ingressclasses" in API group "networking.k8s.io" at the cluster scope
2024-12-17T05:52:04Z	INFO	Not running on OpenShift, so won't configure OAuthProxy imagestream.
2024-12-17T05:52:04Z	INFO	Determining whether we should enable the Elasticsearch Operator integration
2024-12-17T05:52:04Z	INFO	Determining whether we should enable the Kafka Operator integration
W1217 05:52:04.802764       1 reflector.go:539] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: failed to list *v1.IngressClass: ingressclasses.networking.k8s.io is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "ingressclasses" in API group "networking.k8s.io" at the cluster scope
E1217 05:52:04.802798       1 reflector.go:147] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: Failed to watch *v1.IngressClass: failed to list *v1.IngressClass: ingressclasses.networking.k8s.io is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "ingressclasses" in API group "networking.k8s.io" at the cluster scope
W1217 05:52:06.850589       1 reflector.go:539] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: failed to list *v1.IngressClass: ingressclasses.networking.k8s.io is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "ingressclasses" in API group "networking.k8s.io" at the cluster scope
E1217 05:52:06.850629       1 reflector.go:147] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: Failed to watch *v1.IngressClass: failed to list *v1.IngressClass: ingressclasses.networking.k8s.io is forbidden: User "system:serviceaccount:observability:my-release-jaeger-operator" cannot list resource "ingressclasses" in API group "networking.k8s.io" at the cluster scope
2024-12-17T05:52:08Z	INFO	cleaning orphaned deployments.

[iblancasa]

I'm don't know what that configuration from the Helm chart does. But, based on the operator logs... I think it is totally related.