-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
None
-
Incidents & Support
-
Important
-
None
Description of problem:
In RHACM, customer has prepared three Nodes for the installation of OpenShift Container Platform. All Nodes are shown as "Ready":
Customer clicks on "Go to cluster configuration to start the installation". On the "Cluster Details" page, the customer then also clicks "Next".
However, clicking "Next" fails, the wizard does not continue. Investigating it shows that there is the following PATCH request sent:
[{"op":"replace","path":"/spec/imageSetRef/name","value":"openshift-v4.20.5-x86-64"}]
However this is blocked:
admission webhook "agentclusterinstallvalidators.admission.agentinstall.openshift.io" denied the request: Attempted to change AgentClusterInstall.ImageSetRef which is immutable
See also the following screenshot:
It is not clear if this is a UI issue or an RHACM issue and which component tries to set the field.
Version-Release number of selected component (if applicable):
RHACM 2.14
How reproducible:
Always
Steps to Reproduce:
- Using the Agent method, set up three Bare Metal Nodes.
- Validate in the cluster view that all Nodes are shown as "Ready"
- In the UI, click on "Go to cluster configuration to start the installation"
- Review the settings, do not change anything, click "Next"
Actual results:
Clicking "Next" fails, the wizard does not continue. The browser console shows that there is the following PATCH request sent:
[{"op":"replace","path":"/spec/imageSetRef/name","value":"openshift-v4.20.5-x86-64"}]
This is the response:
admission webhook "agentclusterinstallvalidators.admission.agentinstall.openshift.io" denied the request: Attempted to change AgentClusterInstall.ImageSetRef which is immutable
Expected results:
An actionable error message is shown or install wizard continues with the installation without trying to change the field.
Additional info:
YAML output of the wizard:
apiVersion: hive.openshift.io/v1 kind: ClusterDeployment metadata: name: censored-int-01 namespace: censored-int-01 labels: cluster.open-cluster-management.io/clusterset: default hive.openshift.io/cluster-platform: agent-baremetal spec: clusterName: censored-int-01 platform: agentBareMetal: agentSelector: {} baseDomain: cloud.example.com controlPlaneConfig: servingCertificates: {} installed: false pullSecretRef: name: censored-int-01-pull-secret clusterInstallRef: kind: AgentClusterInstall name: censored-int-01 group: extensions.hive.openshift.io version: v1beta1 preserveOnDelete: false --- apiVersion: extensions.hive.openshift.io/v1beta1 kind: AgentClusterInstall metadata: name: censored-int-01 namespace: censored-int-01 spec: clusterDeploymentRef: name: censored-int-01 apiVIP: 192.168.0.8 imageSetRef: name: openshift-v4.18.22-x86-64 ingressVIP: 192.168.0.9 networking: networkType: OVNKubernetes clusterNetwork: - cidr: 10.140.0.0/18 hostPrefix: 23 serviceNetwork: - 1.2.3.4/18 userManagedNetworking: false machineNetwork: - cidr: 5.6.7.8/24 provisionRequirements: controlPlaneAgents: 3 sshPublicKey: >- ssh-ed25519 CENSORED holdInstallation: true manifestsConfigMapRef: name: additional-installation-manifests --- kind: Secret apiVersion: v1 metadata: name: censored-int-01-pull-secret namespace: censored-int-01 labels: agent-install.openshift.io/watch: 'true' cluster.open-cluster-management.io/backup: 'true' data: .dockerconfigjson: >- CENSORED type: kubernetes.io/dockerconfigjson --- apiVersion: cluster.open-cluster-management.io/v1 kind: ManagedCluster metadata: name: censored-int-01 labels: cloud: BareMetal cluster.open-cluster-management.io/clusterset: default feature.open-cluster-management.io/addon-application-manager: unreachable feature.open-cluster-management.io/addon-cert-policy-controller: unreachable feature.open-cluster-management.io/addon-cluster-proxy: unreachable feature.open-cluster-management.io/addon-config-policy-controller: unreachable feature.open-cluster-management.io/addon-governance-policy-framework: unreachable feature.open-cluster-management.io/addon-observability-controller: unreachable feature.open-cluster-management.io/addon-search-collector: unreachable feature.open-cluster-management.io/addon-work-manager: unreachable name: censored-int-01 vendor: OpenShift spec: hubAcceptsClient: true leaseDurationSeconds: 60 taints: - effect: NoSelect key: cluster.open-cluster-management.io/unreachable timeAdded: '2025-12-08T11:47:00Z' --- apiVersion: agent.open-cluster-management.io/v1 kind: KlusterletAddonConfig metadata: name: censored-int-01 namespace: censored-int-01 spec: applicationManager: enabled: true certPolicyController: enabled: true clusterLabels: cloud: Baremetal vendor: OpenShift clusterName: censored-int-01 clusterNamespace: censored-int-01 iamPolicyController: enabled: true policyController: enabled: true searchCollector: enabled: true
