Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-5310

[2.6] Policy propagator does not requeue certain errors

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • ACM 2.6.7
    • ACM 2.6.5
    • GRC
    • 1
    • False
    • None
    • False
    • GRC Sprint 2023-08, GRC Sprint 2023-09
    • No

      Description of problem:

      The specific example where this has happened is when detaching and re-importing a cluster: if the detach process has not fully completed, and the cluster namespace is in a Terminating state, then the propagator can not create the replicated policy in that namespace. It seems to mark the root policy as non-compliant, but does not automatically re-attempt to propagate the policy. I think it's likely that this is not the only type of error that isn't re-queued.

      Version-Release number of selected component (if applicable):

      How reproducible:

      Probably

      Steps to Reproduce:

      1. Artificially add a finalizer to a cluster namespace.
      2. Delete the cluster namespace, and observe it is in a Terminating state.
      3. Create a policy which should be propagated to that cluster namespace.

      Actual results:

      It is not propagated, an error is in the logs like:

      ```
      error policy-propagator propagator/propagation.go:783 Failed to create the replicated policy {"policyName": "my-policy", "policyNamespace": "my-namespace", "replicatePolicyName": "my-namespace.my-policy", "replicatedPolicyNamespace": "my-cluster", "error": "policies.policy.open-cluster-management.io \"my-namespace.my-policy\" is forbidden: unable to create new content in namespace my-cluster because it is being terminated"}
      ```
      and the propagation is not re-attempted.

      Expected results:

      When the cluster namespace is re-created after it finishes terminating, the policy should be automatically propagated to it automatically within a reasonable amount of time.

      Additional info:

              jkulikau@redhat.com Justin Kulikauskas
              jkulikau@redhat.com Justin Kulikauskas
              Derek Ho Derek Ho
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: