# Namespaced vs Clusterscoped Operator Install ?

**URL:** <https://forum.ansible.com/t/namespaced-vs-clusterscoped-operator-install/36095>\
**Category:** AWX Project\
**Tags:** awx, kubernetes\
**Created:** [December 9, 2021, 10:01pm UTC](https://forum.ansible.com/t/namespaced-vs-clusterscoped-operator-install/36095 "2021-12-09T22:01:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dane\_DeValcourt](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Dane\_DeValcourt](https://forum.ansible.com/u/Dane_DeValcourt)\
**Post date:** [December 9, 2021, 10:01pm UTC](https://forum.ansible.com/t/namespaced-vs-clusterscoped-operator-install/36095/1 "2021-12-09T22:01:51Z")

</div>

I understand that Operator needs to be installed and uses cluster scopes for:

customresourcedefinitions, clusterroles, and clusterrole bindings as those inherently are all cluster-scoped

However this PR: [https://github.com/ansible/awx-operator/pull/541](https://github.com/ansible/awx-operator/pull/541) talks about moving from Clusterscoped to namespaced-scoped.

When I do an Operator install using 0.15.0, I am seeing failures related to all the things that are cluster scoped:

[customresourcedefinition.apiextensions.k8s.io/awxbackups.awx.ansible.com](http://customresourcedefinition.apiextensions.k8s.io/awxbackups.awx.ansible.com) created [customresourcedefinition.apiextensions.k8s.io/awxrestores.awx.ansible.com](http://customresourcedefinition.apiextensions.k8s.io/awxrestores.awx.ansible.com) created [customresourcedefinition.apiextensions.k8s.io/awxs.awx.ansible.com](http://customresourcedefinition.apiextensions.k8s.io/awxs.awx.ansible.com) created [clusterrole.rbac.authorization.k8s.io/awx-operator-metrics-reader](http://clusterrole.rbac.authorization.k8s.io/awx-operator-metrics-reader) created [clusterrole.rbac.authorization.k8s.io/awx-operator-proxy-role](http://clusterrole.rbac.authorization.k8s.io/awx-operator-proxy-role) created [clusterrolebinding.rbac.authorization.k8s.io/awx-operator-proxy-rolebinding](http://clusterrolebinding.rbac.authorization.k8s.io/awx-operator-proxy-rolebinding) created

Errors from Operator install:

make deploy  
cd config/manager && /Users/ddevalco/Dropbox/escm/awx19\_5/awx-operator/bin/kustomize edit set image [controller=quay.io/ansible/awx-operator:0.15.0](http://controller=quay.io/ansible/awx-operator:0.15.0)  
cd config/default && /Users/ddevalco/Dropbox/escm/awx19\_5/awx-operator/bin/kustomize edit set namespace escm-stg  
/Users/ddevalco/Dropbox/escm/awx19\_5/awx-operator/bin/kustomize build config/default | kubectl apply -f -  
namespace/escm-stg unchanged  
serviceaccount/awx-operator-controller-manager unchanged  
configmap/awx-operator-awx-manager-config created  
service/awx-operator-controller-manager-metrics-service created  
deployment.apps/awx-operator-controller-manager created  
Error from server (Forbidden): error when retrieving current configuration of:  
Resource: “[apiextensions.k8s.io/v1](http://apiextensions.k8s.io/v1), Resource=customresourcedefinitions”, GroupVersionKind: “[apiextensions.k8s.io/v1](http://apiextensions.k8s.io/v1), Kind=CustomResourceDefinition”  
Name: “[awxbackups.awx.ansible.com](http://awxbackups.awx.ansible.com)”, Namespace: “”  
from server for: “STDIN”: [customresourcedefinitions.apiextensions.k8s.io](http://customresourcedefinitions.apiextensions.k8s.io) “[awxbackups.awx.ansible.com](http://awxbackups.awx.ansible.com)” is forbidden: User “u-w4453qrfpa” cannot get resource “customresourcedefinitions” in API group “[apiextensions.k8s.io](http://apiextensions.k8s.io)” at the cluster scope  
Error from server (Forbidden): error when retrieving current configuration of:  
Resource: “[apiextensions.k8s.io/v1](http://apiextensions.k8s.io/v1), Resource=customresourcedefinitions”, GroupVersionKind: “[apiextensions.k8s.io/v1](http://apiextensions.k8s.io/v1), Kind=CustomResourceDefinition”  
Name: “[awxrestores.awx.ansible.com](http://awxrestores.awx.ansible.com)”, Namespace: “”  
from server for: “STDIN”: [customresourcedefinitions.apiextensions.k8s.io](http://customresourcedefinitions.apiextensions.k8s.io) “[awxrestores.awx.ansible.com](http://awxrestores.awx.ansible.com)” is forbidden: User “u-w4453qrfpa” cannot get resource “customresourcedefinitions” in API group “[apiextensions.k8s.io](http://apiextensions.k8s.io)” at the cluster scope  
Error from server (Forbidden): error when retrieving current configuration of:  
Resource: “[apiextensions.k8s.io/v1](http://apiextensions.k8s.io/v1), Resource=customresourcedefinitions”, GroupVersionKind: “[apiextensions.k8s.io/v1](http://apiextensions.k8s.io/v1), Kind=CustomResourceDefinition”  
Name: “[awxs.awx.ansible.com](http://awxs.awx.ansible.com)”, Namespace: “”  
from server for: “STDIN”: [customresourcedefinitions.apiextensions.k8s.io](http://customresourcedefinitions.apiextensions.k8s.io) “[awxs.awx.ansible.com](http://awxs.awx.ansible.com)” is forbidden: User “u-w4453qrfpa” cannot get resource “customresourcedefinitions” in API group “[apiextensions.k8s.io](http://apiextensions.k8s.io)” at the cluster scope  
Error from server (Forbidden): error when creating “STDIN”: [roles.rbac.authorization.k8s.io](http://roles.rbac.authorization.k8s.io) “awx-operator-awx-manager-role” is forbidden: user “u-w4453qrfpa” (groups=[“azuread\_group://“system:authenticated” “system:cattle:authenticated”]) is attempting to grant RBAC permissions not currently held:  
{APIGroups:[”“], Resources:[“events”], Verbs:[“delete”]}  
{APIGroups:[”“], Resources:[“pods/log”], Verbs:[“create”]}  
{APIGroups:[”“], Resources:[“rolebindings”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[”“], Resources:[“roles”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[”“], Resources:[“services/finalizers”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“apps”], Resources:[“deployments/finalizers”], ResourceNames:[“awx-operator”], Verbs:[“update”]}  
{APIGroups:[“apps”], Resources:[“ingresses”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[awx.ansible.com](http://awx.ansible.com)”], Resources:[”_“], Verbs:[”_“]}  
{APIGroups:[“[awx.ansible.com](http://awx.ansible.com)”], Resources:[“awxbackups”], Verbs:[”_“]}  
{APIGroups:[“[awx.ansible.com](http://awx.ansible.com)”], Resources:[“awxrestores”], Verbs:[”_"]}  
{APIGroups:[“[networking.k8s.io](http://networking.k8s.io)”], Resources:[“daemonsets”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[networking.k8s.io](http://networking.k8s.io)”], Resources:[“deployments”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[networking.k8s.io](http://networking.k8s.io)”], Resources:[“replicasets”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[networking.k8s.io](http://networking.k8s.io)”], Resources:[“statefulsets”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“configmaps”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“endpoints”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“events”], Verbs:[“get” “list” “delete” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“persistentvolumeclaims”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“pods”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“secrets”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“serviceaccounts”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“services”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)”], Resources:[“services/finalizers”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[route.openshift.io](http://route.openshift.io)”], Resources:[“routes”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
{APIGroups:[“[route.openshift.io](http://route.openshift.io)”], Resources:[“routes/custom-host”], Verbs:[“get” “list” “create” “delete” “patch” “update” “watch”]}  
Error from server (Forbidden): error when creating “STDIN”: [roles.rbac.authorization.k8s.io](http://roles.rbac.authorization.k8s.io) “awx-operator-leader-election-role” is forbidden: user “u-w4453qrfpa” (groups=["azuread\_group:// “system:authenticated” “system:cattle:authenticated”]) is attempting to grant RBAC permissions not currently held:  
{APIGroups:[“[coordination.k8s.io](http://coordination.k8s.io)”], Resources:[“leases”], Verbs:[“get” “list” “watch” “create” “update” “patch” “delete”]}  
Error from server (Forbidden): error when retrieving current configuration of:  
Resource: “[rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1), Resource=clusterroles”, GroupVersionKind: “[rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1), Kind=ClusterRole”  
Name: “awx-operator-metrics-reader”, Namespace: “”  
from server for: “STDIN”: [clusterroles.rbac.authorization.k8s.io](http://clusterroles.rbac.authorization.k8s.io) “awx-operator-metrics-reader” is forbidden: User “u-w4453qrfpa” cannot get resource “clusterroles” in API group “[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)” at the cluster scope  
Error from server (Forbidden): error when retrieving current configuration of:  
Resource: “[rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1), Resource=clusterroles”, GroupVersionKind: “[rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1), Kind=ClusterRole”  
Name: “awx-operator-proxy-role”, Namespace: “”  
from server for: “STDIN”: [clusterroles.rbac.authorization.k8s.io](http://clusterroles.rbac.authorization.k8s.io) “awx-operator-proxy-role” is forbidden: User “u-w4453qrfpa” cannot get resource “clusterroles” in API group “[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)” at the cluster scope  
Error from server (NotFound): error when creating “STDIN”: [roles.rbac.authorization.k8s.io](http://roles.rbac.authorization.k8s.io) “awx-operator-awx-manager-role” not found  
Error from server (NotFound): error when creating “STDIN”: [roles.rbac.authorization.k8s.io](http://roles.rbac.authorization.k8s.io) “awx-operator-leader-election-role” not found  
Error from server (Forbidden): error when retrieving current configuration of:  
Resource: “[rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1), Resource=clusterrolebindings”, GroupVersionKind: “[rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1), Kind=ClusterRoleBinding”  
Name: “awx-operator-proxy-rolebinding”, Namespace: “”  
from server for: “STDIN”: [clusterrolebindings.rbac.authorization.k8s.io](http://clusterrolebindings.rbac.authorization.k8s.io) “awx-operator-proxy-rolebinding” is forbidden: User “u-w4453qrfpa” cannot get resource “clusterrolebindings” in API group “[rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)” at the cluster scope  
make: \*\*\* [deploy] Error 1

I guess I’m confused about this PR I mentioned above and the fact it alludes to moving away from anything cluster scoped, yet I’m still seeing errors that indicate you can’t really completely move everything from being cluster scoped?

Just can’t seem to get past these errors to install via Operator and wondering what am I missing understanding about this.

Thanks, Dane