Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-4606

Policy propagator does not requeue certain errors

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • ACM 2.8.0, ACM 2.7.3
    • ACM 2.8.0, ACM 2.7.2
    • GRC
    • 2
    • False
    • None
    • False
    • No
    • -
    • GRC Sprint 2023-05

      Description of problem:

      The specific example where this has happened is when detaching and re-importing a cluster: if the detach process has not fully completed, and the cluster namespace is in a Terminating state, then the propagator can not create the replicated policy in that namespace. It seems to mark the root policy as non-compliant, but does not automatically re-attempt to propagate the policy. I think it's likely that this is not the only type of error that isn't re-queued.

      Version-Release number of selected component (if applicable):

      How reproducible:

      Probably

      Steps to Reproduce:

      1. Artificially add a finalizer to a cluster namespace.
      2. Delete the cluster namespace, and observe it is in a Terminating state.
      3. Create a policy which should be propagated to that cluster namespace.

      Actual results:

      It is not propagated, an error is in the logs like:

      ```
      error policy-propagator propagator/propagation.go:783 Failed to create the replicated policy {"policyName": "my-policy", "policyNamespace": "my-namespace", "replicatePolicyName": "my-namespace.my-policy", "replicatedPolicyNamespace": "my-cluster", "error": "policies.policy.open-cluster-management.io \"my-namespace.my-policy\" is forbidden: unable to create new content in namespace my-cluster because it is being terminated"}
      ```
      and the propagation is not re-attempted.

      Expected results:

      When the cluster namespace is re-created after it finishes terminating, the policy should be automatically propagated to it automatically within a reasonable amount of time.

      Additional info:

            jkulikau@redhat.com Justin Kulikauskas
            jkulikau@redhat.com Justin Kulikauskas
            Derek Ho Derek Ho
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: