Uploaded image for project: 'OpenShift API Server'
  1. OpenShift API Server
  2. API-1525

service-ca should start faster when installing SNO

    XMLWordPrintable

Details

    • Task
    • Resolution: Done
    • Undefined
    • None
    • None
    • None
    • None

    Description

      openshift- service-ca service-ca pod takes a few minutes to start when installing SNO

      kubectl get events -n openshift-service-ca --sort-by='.metadata.creationTimestamp' -o custom-columns=FirstSeen:.firstTimestamp,LastSeen:.lastTimestamp,Count:.count,From:.source.component,Type:.type,Reason:.reason,Message:.message                      
      FirstSeen              LastSeen               Count   From                                                                                              Type      Reason                 Message
      2023-01-22T12:25:58Z   2023-01-22T12:25:58Z   1       deployment-controller                                                                             Normal    ScalingReplicaSet      Scaled up replica set service-ca-6dc5c758d to 1
      2023-01-22T12:26:12Z   2023-01-22T12:27:53Z   9       replicaset-controller                                                                             Warning   FailedCreate           Error creating: pods "service-ca-6dc5c758d-" is forbidden: error fetching namespace "openshift-service-ca": unable to find annotation openshift.io/sa.scc.uid-range
      2023-01-22T12:27:58Z   2023-01-22T12:27:58Z   1       replicaset-controller                                                                             Normal    SuccessfulCreate       Created pod: service-ca-6dc5c758d-k7bsd
      2023-01-22T12:27:58Z   2023-01-22T12:27:58Z   1       default-scheduler                                                                                 Normal    Scheduled              Successfully assigned openshift-service-ca/service-ca-6dc5c758d-k7bsd to master1
       

      Seems that creating the serivce-ca namespace early allows it to get
      openshift.io/sa.scc.uid-range annotation and start running earlier, the
      service-ca pod is required for other pods (CVO and all the control plane pods) to start since it's creating the serving-cert 

      Attachments

        Activity

          People

            ercohen Eran Cohen
            ercohen Eran Cohen
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: