Filebeat Helm deployment reports use of deprected k8s api

[rpastrana]

Chart version:
7.9.3
Kubernetes version:
v3.5.0
Kubernetes provider: E.g. GKE (Google Kubernetes Engine)
Minikube

Helm Version:
v3.5.0

helm get release output

e.g. helm get elasticsearch (replace elasticsearch with the name of your helm release)

Be careful to obfuscate every secrets (credentials, token, public IP, ...) that could be visible in the output before copy-pasting.

If you find some secrets in plain text in helm get release output you should use Kubernetes Secrets to managed them is a secure way (see Security Example).

Output of helm get release

Helm based deployment of Filebeat, and ES produce the following warnings:

W0128 13:25:59.736302 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
W0128 13:25:59.738266 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding
W0128 13:25:59.832285 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
W0128 13:25:59.837044 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding

Steps to reproduce:

1. Add ElasticSearch, Filebeat, Kibana as helm dependencies
2. Update charts dir w/ Elastic Charts via Helm update dependencies
3. Install helm chart
4. Observe warnings:

W0128 13:25:59.736302 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
W0128 13:25:59.738266 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding
W0128 13:25:59.832285 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
W0128 13:25:59.837044 3118 warnings.go:70] rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding

Expected behavior:
No ClusterRole, ClusterRoleBinding warnings
Provide logs and/or server output (if relevant):
See above

Be careful to obfuscate every secrets (credentials, token, public IP, ...) that could be visible in the output before copy-pasting

Asked questions here, but received no traction: https://discuss.elastic.co/t/filebeat-helm-deployment-reports-use-of-deprected-k8s-api/262671

[jmlrt]

Hi @rpastrana,
Thanks for opening this issue.
Unfortunately we currently don't have time to investigate every tickets so please be patient.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[rpastrana]

Hi @jmlrt, is Elastic planing on supporting K8s v1.17+ ? If so, it seems this issue needs to be addressed. Thanks.

[jmlrt]

@rpastrana, ClusterRole and ClusterRoleBindingare still working until 1.22 so this will be adressed in time.

[rpastrana]

@jmlrt great to hear! Will that change be tracked by this ticket?

[jmlrt]

Yes it is. We have really low bandwith currently so unfortunately I don't expect it to be worked soon but we have some time until 1.22.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[rpastrana]

Commenting in hopes this does comes out of triage/stale

[jmlrt]

Hi @rpastrana, I took a bit more time to investigate this, and I don't find any place where rbac.authorization.k8s.io/v1beta1 is still used in our charts.

From what I see, everything was already done in #890.

Can you give a bit more details about what is still missing?

[cohenuzi01]

The ingress object still uses networking.k8s.io/v1beta1

See other defects (duplicate?) #1444

[codebue]

Hi,
I cannot helm install metricbeat elastic/metricbeat because of

Error: INSTALLATION FAILED: unable to build kubernetes objects from release manifest: [unable to recognize "": no matches for kind "ClusterRole" in version "rbac.authorization.k8s.io/v1beta1", unable to recognize "": no matches for kind "ClusterRoleBinding" in version "rbac.authorization.k8s.io/v1beta1"]

My suspicion is that the reference to "rbac.authorization.k8s.io/v1beta1" is still included in the included template file ...
cat metricbeat/charts/kube-state-metrics/templates/clusterrole.yaml

{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1

Helm chart version 7.16.1

Helm version 3.7.2

Minikube version: 1.24.0

kubectl version

Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.1", GitCommit:"86ec240af8cbd1b60bcc4c03c20da9b98005b92e", GitTreeState:"clean", BuildDate:"2021-12-16T11:41:01Z", GoVersion:"go1.17.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.3", GitCommit:"c92036820499fedefec0f847e2054d824aea6cd1", GitTreeState:"clean", BuildDate:"2021-10-27T18:35:25Z", GoVersion:"go1.16.9", Compiler:"gc", Platform:"linux/amd64"}

workaround:
edited
metricbeat/charts/kube-state-metrics/templates/clusterrole.yaml
+
metricbeat/charts/kube-state-metrics/templates/clusterrolebinding.yaml
in unpacked .tgz to use apiVersion: rbac.authorization.k8s.io/v1 instead and then helm install metricbeat ./metricbeat worked as expected with 3 pods running
metricbeat-kube-state-metrics-75c5fc65d9-rlhfc 1/1 Running 0 2m8s
metricbeat-metricbeat-metrics-54c49cdfb-5tc7f 1/1 Running 0 2m8s
metricbeat-metricbeat-p52gq 1/1 Running 0 2m8s

[beatkind]

@codebue this seems to be the case because the reference to kube-state-metrics is quite old. They changed the ClusterRole API with this commit: prometheus-community/helm-charts@0e9f68e

But this is the version 2.9.3 metricbeat is using 2.4.1 in the requirements file.

[beatkind]

@jmlrt this is not related to filebeat anymore but to metricbeat. I just pushed a PR #1524 to address this.

[jmlrt]

Closing this issue as it was created for Filebeat.
The remaining change for Metricbeat is tracked in #1576