# Linkerd-viz namespace-metadata not working on RKE2 cluster

**URL:** <https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316>\
**Category:** Linkerd General Discussion\
**Tags:** configuration\
**Created:** [November 7, 2023, 2:30pm UTC](https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316 "2023-11-07T14:30:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Corentin](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@Corentin](https://linkerd.buoyant.io/u/Corentin)\
**Post date:** [November 7, 2023, 2:30pm UTC](https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316/1 "2023-11-07T14:30:47Z")

</div>

Hello,

I’m trying to install linkerd on a RKE2 cluster.  
This cluster is created with a cis-1.23 profile as recommended on the RKE2 website: [CIS Hardening Guide | RKE2](https://docs.rke2.io/security/hardening_guide)

When I install linkerd-viz, the namespace-metadata pod starts. I think it tries to add custom labels to the linkerd (or linkerd-viz ?) namespace. But it fails.

`ERROR linkerd_extension_init: failed patching namespace: ApiError: admission webhook "rancher.cattle.io.namespaces" denied the request: Unauthorized: Unauthorized (ErrorResponse { status: "Failure", message: "admission webhook \"rancher.cattle.io.namespaces\" denied the request: Unauthorized", reason: "Unauthorized", code: 403 })`

The erros is pretty clear, the namesapce can’t be updated beacause Rancher Admission Webhook doesn’t authorize the modification.  
However I have no idea how i can get through this problem.

Anyone has an idea ?

Thank you,  
Corentin

---

<div class="post-metadata">

**Author:** ![alpeb](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/alpeb/32/61_2.png) [@alpeb](https://linkerd.buoyant.io/u/alpeb)\
**Post date:** [November 7, 2023, 4:36pm UTC](https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316/2 "2023-11-07T16:36:03Z")

</div>

I understand how constrained environments might deny edition privileges to namespaces. In this particular case, you can delete the `namespace-metadata` Job and perform what it wants to do manually, which is adding the following metadata to the `linkerd-viz` namespace:

- `linkerd.io/extension: viz` label
- `pod-security.kubernetes.io/enforce` label set to `privileged`, or if you’re using the `linkerd-cni` plugin, set to `restricted`.
- If you’re using a different Prometheus instance than the one provided by default, you should refer to it in the `viz.linkerd.io/external-prometheus` annotation.

Note to self: we should provide an option to disable this Job! 🙂

---

<div class="post-metadata">

**Author:** ![Corentin](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@Corentin](https://linkerd.buoyant.io/u/Corentin)\
**Post date:** [November 7, 2023, 4:43pm UTC](https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316/3 "2023-11-07T16:43:56Z")

</div>

Hello,

Thank you for the answering my question.  
I can delete the job manually but this won’t make my ArgoCD happy. 😃

You’re right, maybe the best option is to provide an option to disable this job.  
For now i’ll delete it manually and apply this metadata myself.

---

<div class="post-metadata">

**Author:** ![alpeb](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/alpeb/32/61_2.png) [@alpeb](https://linkerd.buoyant.io/u/alpeb)\
**Post date:** [November 7, 2023, 4:49pm UTC](https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316/4 "2023-11-07T16:49:30Z")

</div>

I’ve added [this ticket](https://github.com/linkerd/linkerd2/issues/11585) asking for help to implement that option 😉

---

<div class="post-metadata">

**Author:** ![Corentin](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@Corentin](https://linkerd.buoyant.io/u/Corentin)\
**Post date:** [November 7, 2023, 4:51pm UTC](https://linkerd.buoyant.io/t/linkerd-viz-namespace-metadata-not-working-on-rke2-cluster/316/5 "2023-11-07T16:51:05Z")

</div>

Well thank you for your time. 🙂