Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-15038

OwnerRefInvalidNamespace rolebinding/keda-auth-reader in kube-system

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • 4.13, 4.12, 4.11, 4.10
    • Pod Autoscaler
    • +
    • Moderate
    • No
    • 2
    • OCPNODE Sprint 238 (Green)
    • 1
    • False
    • Hide

      None

      Show
      None
    • Hide
      Cause:
      A bug in Custom Metrics Autoscaler Operator caused it to attempt to take ownership of all managed objects, even cluster-scoped objects and objects in other namespaces.
      Consequence:
      Custom Metrics Autoscaler was unable to create a rolebinding for reading the credentials necessary to be an API server. This caused error events in the kube-system namespace.
      Fix:
      The Custom Metrics Autoscaler Operator skips adding the ownerReference field on any cluster-scoped object or object in another namespace.
      Result:
      The rolebinding is now created without any errors.
      Show
      Cause: A bug in Custom Metrics Autoscaler Operator caused it to attempt to take ownership of all managed objects, even cluster-scoped objects and objects in other namespaces. Consequence: Custom Metrics Autoscaler was unable to create a rolebinding for reading the credentials necessary to be an API server. This caused error events in the kube-system namespace. Fix: The Custom Metrics Autoscaler Operator skips adding the ownerReference field on any cluster-scoped object or object in another namespace. Result: The rolebinding is now created without any errors.
    • Bug Fix
    • Proposed

      Description of problem:

      After installing KEDA GA, once the KedaController CR is created, it's observed the error below:

$ oc get events -n kube-system|grep -i keda
4m51s       Warning   OwnerRefInvalidNamespace   rolebinding/keda-auth-reader   ownerRef [keda.sh/v1alpha1/KedaController, namespace: kube-system, name: keda, uid: 1e9a6cd3-17e8-4dec-832f-64ab6db759fe] does not exist in namespace "kube-system"
...

      Version-Release number of selected component (if applicable):

      $ oc get clusterversion
NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.13.1    True        False         3h55m   Cluster version is 4.13.1

$ oc get csv -n openshift-keda
NAME                                    DISPLAY                            VERSION      REPLACES                        PHASE
custom-metrics-autoscaler.v2.10.1-253   Custom Metrics Autoscaler          2.10.1-253                                   Succeeded

      How reproducible:

      Always

      Steps to Reproduce:

      1. Install KEDA GA version - 2.10.1-253 

2. Create KedaController CRD, as for example:
```
$ cat kedaController.yaml 
apiVersion: keda.sh/v1alpha1
kind: KedaController
metadata:
  creationTimestamp: "2023-06-14T12:25:31Z"
  finalizers:
  - finalizer.kedacontroller.keda.sh
  generation: 1
  name: keda
  namespace: openshift-keda
  resourceVersion: "944510"
  uid: e39a65a8-67a2-40e6-85b3-726a4307b3b6
spec:
  admissionWebhooks:
    logEncoder: console
    logLevel: info
  metricsServer:
    logLevel: "0"
  operator:
    logEncoder: console
    logLevel: info
  watchNamespace: ""
```

3. Verify logs in the kube-system namespace indicating `OwnerRefInvalidNamespace rolebinding/keda-auth-reader`

```
$ oc get events -n kube-system|grep -i keda 4m51s       Warning   OwnerRefInvalidNamespace   rolebinding/keda-auth-reader   ownerRef [keda.sh/v1alpha1/KedaController, namespace: kube-system, name: keda, uid: 1e9a6cd3-17e8-4dec-832f-64ab6db759fe] does not exist in namespace "kube-system" ... 
```

4. Confirm that the roledinding doesn't exist in the kube-system namespace:

```
$ oc get rolebinding/keda-auth-reader -n kube-system
Error from server (NotFound): rolebindings.rbac.authorization.k8s.io "keda-auth-reader" not found
```

      Actual results:

      Observed OwnerRefInvalidNamespace in the kube-system namespace 

```
$ oc get events -n kube-system|grep -i keda 4m51s       Warning   OwnerRefInvalidNamespace   rolebinding/keda-auth-reader   ownerRef [keda.sh/v1alpha1/KedaController, namespace: kube-system, name: keda, uid: 1e9a6cd3-17e8-4dec-832f-64ab6db759fe] does not exist in namespace "kube-system" ...
```

      Expected results:

      Not errors

      Additional info:

       

            joelsmith.redhat Joel Smith
            rhn-support-ocasalsa Oscar Casal Sanchez
            Weinan Liu Weinan Liu
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: