Description of problem:

Installed agent-based hypershift cluster on 4.15 disconnected hub cluster using MCE 2.5. The deployment of hosted cluster is successful but on the hub cluster a bunch of hypershift-install-job pods are getting created and they all end up in Error state. From the events in open-cluster-management-agent-addon namespace:

137m        Warning   FailedToRetrieveImagePullSecret   pod/hypershift-install-job-x5lp6-bhp4t           Unable to retrieve some image pull secrets (open-cluster-management-image-pull-credentials); attempting to pull the image may not succeed.  

The pod logs show the following error:

Error: validatingwebhookconfigurations.admissionregistration.k8s.io "hypershift.openshift.io" is forbidden: User "system:serviceaccount:open-cluster-management-agent-addon:hypershift-addon-agent-sa" cannot patch resource "validatingwebhookconfigurations" in API group "admissionregistration.k8s.io" at the cluster scope validatingwebhookconfigurations.admissionregistration.k8s.io "hypershift.openshift.io" is forbidden: User "system:serviceaccount:open-cluster-management-agent-addon:hypershift-addon-agent-sa" cannot patch resource "validatingwebhookconfigurations" in API group "admissionregistration.k8s.io" at the cluster scope  

See full pod logs in attachment hypershift-install-job.log

Output of oc describe: hypershift-install-job-pod

Events in open-cluster-management-agent-addon namespace: events_open-cluster-management-agent-addon

must-gather:  must-gather.tar.gz

Version-Release number of selected component (if applicable):

MCE 2.5.0-DOWNANDBACK-2024-01-03-21-48-19

OCP 4.15.0-0.nightly-2024-01-03-140457

How reproducible:

100%

Steps to Reproduce:

1. Install OCP 4.15 disconnected hub cluster
2. Install MCE 2.5
3. Install Hypershift Operator via MCE Add-On

Actual results:

A bunch of hypershift-install-job pods are getting created and end up in Error state. This doesn't seem to affect deployment of hosted cluster though

Expected results:

hypershift-install-job pods not in Error state

Additional info:

The hypershift operator pods are getting continuously re-created, not sure if related