XRAY: How to Resolve RabbitMQ Migration Job Failing with "configmaps is forbidden" When Deploying Xray Using Helm

Overview

During an Xray installation or upgrade using the Helm chart, the RabbitMQ migration job may fail with an error similar to:

New RabbitMQ image tag: 3.13.7-debian-12-r6

RabbitMQ image tag has not changed. Skipping feature flag migration.

Creating ConfigMap with current RabbitMQ StatefulSet replica count

error: failed to create configmap: configmaps is forbidden:
User "system:serviceaccount:xray:xray-rabbitmq-migration"
cannot create resource "configmaps" in API group ""
in the namespace "xray"

Failed to create ConfigMap xray-rabbitmq-deployment-status



Cause

This error indicates that the `xray-rabbitmq-migration` service account does not have sufficient Kubernetes RBAC permissions to create ConfigMaps in the Xray namespace.

Even if RBAC permissions were recently added, the issue can still occur if:

Permissions were granted to a different service account.
The RoleBinding is associated with the wrong service account or namespace.
RBAC creation for the RabbitMQ migration job is disabled or overridden in the Helm values.
A previously failed migration job is still present.


Resolution

Step 1: Verify the Helm Values

Ensure the RabbitMQ migration service account and its RBAC resources are enabled.

rabbitmq:
  migration:
    serviceAccount:
      create: true
      rbac:
        create: true

Also verify that RBAC creation is enabled globally:

rbac:
  create: true

If you are using custom values, ensure they do not override or disable these settings.

Step 2: Verify the Service Account Permissions

Run the following command to verify that the migration service account can create ConfigMaps:

kubectl auth can-i create configmaps \
  -n xray \
  --as=system:serviceaccount:xray:xray-rabbitmq-migration

The expected output is:

yes

If the output is `no`, review the Role and RoleBinding associated with the `xray-rabbitmq-migration` service account.

The service account must have permissions to create, get, and patch ConfigMaps.

Step 3: Verify the RoleBinding

Confirm that:

The RoleBinding references the `xray-rabbitmq-migration` service account.
The RoleBinding exists in the correct namespace.
The referenced Role includes the required ConfigMap permissions.

Step 4: Re-run the Migration Job

If a previous pre-upgrade migration job failed before the RBAC changes were applied, delete the failed job and rerun the Helm upgrade.

This allows Kubernetes to recreate the migration job using the updated service account permissions.

Summary

The `configmaps is forbidden` error is caused by insufficient RBAC permissions for the `xray-rabbitmq-migration` service account. Ensuring that the migration service account, RBAC resources, and RoleBindings are correctly configured resolves the issue in most deployments.