Restore remote access to the CNF namespaces when using the CNF terminal or kubectl
functionality of TCA.
Symptoms:
kubectl get pods -n <namespace of the CNF>
results in the following error:Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:tca-rbac:########-####-####-####-############ cannot list resource "pods" in API group "" in the namespace "<CNF namespace>"
2.x
This is caused during the CNF terminate procedure where the required roles and role-bindings are deleted along with the CNF namespace. During the re-instantiation they are not re-created.
This problem will be fixed in TCA 3.0. However, the problem can be resolved manually, even on TCA 2.3, by following the steps listed below in the Workaround section of this article.
Complete the following steps:
kubectl delete serviceaccount -n tca-rbac -l 'tca.vmware.com/cnfId=CNF identifier'
kubectl
on the problematic CNF.sudo systemctl restart proxy
NOTE: The CNF Identifier can be found by expanding the arrow of the CNF within the Network Function Inventory page.
Do not delete the CNF namespace and resources in the CNF namespace which are created by TCA. Either remove this step from CNF post-terminate workflow or remove it from the manual re-instantiation procedure.