-
Bug
-
Resolution: Unresolved
-
Blocker
-
ACM 2.14.0, MCE 2.10.0, ACM 2.15.0
-
Quality / Stability / Reliability
-
False
-
-
False
-
-
-
Installer Sprint 2025-70
-
Critical
-
Yes
Description of problem:
ACM is failing to install on ROSA-CLASSIC clusters OCP 4.19.13
Version-Release number of selected component (if applicable):
latest 2.15
How reproducible: Always
Steps to Reproduce:
- Deploy a ROSA_CLASSIC cluster
- Install ACM 2.15.0
Actual results:
ACM is failing to install and I'm seeing this error
2025-10-06T17:21:43.643Z INFO reconcile Reconciling MultiClusterHub
2025-10-06T17:21:43.653Z INFO overrides Found overrides from environment variables set by OPERAND_IMAGE_ prefix
2025-10-06T17:21:43.653Z INFO reconcile Overriding Image Repository from annotation: quay.io:443/acm-d
2025-10-06T17:21:43.653Z INFO reconcile No updates to defaults detected
2025-10-06T17:21:43.755Z INFO Default StorageClassName set from cluster resources {"Name": "gp3"}
2025-10-06T17:21:43.858Z INFO reconcile Adding label: openshift.io/cluster-monitoring to namespace: ocm
2025-10-06T17:21:43.875Z ERROR reconcile Failed to update namespace for MultiClusterHub: ocm with the label: openshift.io/cluster-monitoring {"error": "admission webhook \"namespace-validation.managed.openshift.io\" denied the request: Denied. Err Managed OpenShift customers may only remove the following protected labels from Namespaces: ([openshift.io/cluster-monitoring])"}
github.com/stolostron/multiclusterhub-operator/controllers.(*MultiClusterHubReconciler).ensureOpenShiftNamespaceLabel
/workspace/controllers/infrastructure.go:63
github.com/stolostron/multiclusterhub-operator/controllers.(*MultiClusterHubReconciler).Reconcile
/workspace/controllers/reconcile.go:231
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:222
2025-10-06T17:21:43.875Z ERROR reconcile Failed to add to %s label to namespace: %s {"openshift.io/cluster-monitoring": "ocm", "error": "admission webhook \"namespace-validation.managed.openshift.io\" denied the request: Denied. Err Managed OpenShift customers may only remove the following protected labels from Namespaces: ([openshift.io/cluster-monitoring])"}
github.com/stolostron/multiclusterhub-operator/controllers.(*MultiClusterHubReconciler).Reconcile
/workspace/controllers/reconcile.go:233
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:222
2025-10-06T17:21:43.885Z INFO reconcile Failed to update status {"Reason": "Object has been modified"}
2025-10-06T17:21:43.885Z INFO Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes reqeueuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler {"controller": "multiclusterhub", "controllerGroup": "operator.open-cluster-management.io", "controllerKind": "MultiClusterHub", "MultiClusterHub": {"name":"multiclusterhub","namespace":"ocm"}, "namespace": "ocm", "name": "multiclusterhub", "reconcileID": "355eb442-bb2c-4dba-9cba-38e7d0646047"}
2025-10-06T17:21:43.885Z ERROR Reconciler error {"controller": "multiclusterhub", "controllerGroup": "operator.open-cluster-management.io", "controllerKind": "MultiClusterHub", "MultiClusterHub": {"name":"multiclusterhub","namespace":"ocm"}, "namespace": "ocm", "name": "multiclusterhub", "reconcileID": "355eb442-bb2c-4dba-9cba-38e7d0646047", "error": "admission webhook \"namespace-validation.managed.openshift.io\" denied the request: Denied. Err Managed OpenShift customers may only remove the following protected labels from Namespaces: ([openshift.io/cluster-monitoring])"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:324
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.5/pkg/internal/controller/controller.go:222
Expected results:
ACM should be installed successfully
Additional info:
-------------------------------------------------------------------------------------------------------
QE Hand Off Template (fill out when moving to Review) 10/13/25:
Summary of the Work:
What was implemented or fixed? Include a brief description of the problem (if applicable) and how it was addressed.
e.g., "Updated the UI to show validation errors for the form. The previous implementation did not surface backend validation issues."
Key Areas to Verify:
- What functionality should QE focus on? List what was tested or what is most important to validate.
- Ensure the new validation messages appear for required fields
- Confirm the workflow still completes as expected after validation fixes
- Any edge cases or high-risk areas touched by the change
Fix or Feature Availability:
When will this be available in a build?
Code merged on: YYYY-MM-DD
Expected downstream build tag (if known): example-build-tag
(Optional) Related PR(s): Link
