One of the steps to install OLM in a OCP cluster is to run the registry authorization playbook (https://docs.openshift.com/container-platform/3.11/install_config/installing-operator-framework.html#installing-olm-using-ansible_installing-operator-framework). There is an error during the run that prevents the registry authorization playbook to finish successfully.

The task "openshift_control_plane : Check for file paths outside of /etc/origin/master in master's config" fails because if finds a string "/dev/null" within the master-config.yaml file for the master configuration. This string is added during the configuration patch step that we execute when preparing the cluster to install Istio.

The two webhooks read:

MutatingAdmissionWebhook:
configuration:
apiVersion: apiserver.config.k8s.io/v1alpha1
kind: WebhookAdmission
kubeConfigFile: /dev/null
ValidatingAdmissionWebhook:
configuration:
apiVersion: apiserver.config.k8s.io/v1alpha1
kind: WebhookAdmission
kubeConfigFile: /dev/null

These two lines are the problem causing the playbook to fail.

The way I sorted it out for now is, I created a soft link from /var/lib/origin/null -> /dev/null and I replaced the two /dev/null variables above to /var/lib/origin/null. This will make the task "think" the /var/lib/origin/null is an asset within the origin "perimeter" and carry on.

Early Access Program customers will find this issue if they also want to play with the Operator Framework Tech Preview.