Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-15038

OwnerRefInvalidNamespace rolebinding/keda-auth-reader in kube-system

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Normal
    • None
    • 4.13, 4.12, 4.11, 4.10
    • Pod Autoscaler
    • +
    • Moderate
    • No
    • 2
    • OCPNODE Sprint 238 (Green)
    • 1
    • False
    • Hide

      None

      Show
      None
    • Hide
      Cause:
      A bug in Custom Metrics Autoscaler Operator caused it to attempt to take ownership of all managed objects, even cluster-scoped objects and objects in other namespaces.
      Consequence:
      Custom Metrics Autoscaler was unable to create a rolebinding for reading the credentials necessary to be an API server. This caused error events in the kube-system namespace.
      Fix:
      The Custom Metrics Autoscaler Operator skips adding the ownerReference field on any cluster-scoped object or object in another namespace.
      Result:
      The rolebinding is now created without any errors.
      Show
      Cause: A bug in Custom Metrics Autoscaler Operator caused it to attempt to take ownership of all managed objects, even cluster-scoped objects and objects in other namespaces. Consequence: Custom Metrics Autoscaler was unable to create a rolebinding for reading the credentials necessary to be an API server. This caused error events in the kube-system namespace. Fix: The Custom Metrics Autoscaler Operator skips adding the ownerReference field on any cluster-scoped object or object in another namespace. Result: The rolebinding is now created without any errors.
    • Bug Fix
    • Proposed

    Description

      Description of problem:

      After installing KEDA GA, once the KedaController CR is created, it's observed the error below:
      
      $ oc get events -n kube-system|grep -i keda
      4m51s       Warning   OwnerRefInvalidNamespace   rolebinding/keda-auth-reader   ownerRef [keda.sh/v1alpha1/KedaController, namespace: kube-system, name: keda, uid: 1e9a6cd3-17e8-4dec-832f-64ab6db759fe] does not exist in namespace "kube-system"
      ...

      Version-Release number of selected component (if applicable):

      $ oc get clusterversion
      NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
      version   4.13.1    True        False         3h55m   Cluster version is 4.13.1
      
      $ oc get csv -n openshift-keda
      NAME                                    DISPLAY                            VERSION      REPLACES                        PHASE
      custom-metrics-autoscaler.v2.10.1-253   Custom Metrics Autoscaler          2.10.1-253                                   Succeeded

      How reproducible:

      Always 

      Steps to Reproduce:

      1. Install KEDA GA version - 2.10.1-253 
      
      2. Create KedaController CRD, as for example:
      ```
      $ cat kedaController.yaml 
      apiVersion: keda.sh/v1alpha1
      kind: KedaController
      metadata:
        creationTimestamp: "2023-06-14T12:25:31Z"
        finalizers:
        - finalizer.kedacontroller.keda.sh
        generation: 1
        name: keda
        namespace: openshift-keda
        resourceVersion: "944510"
        uid: e39a65a8-67a2-40e6-85b3-726a4307b3b6
      spec:
        admissionWebhooks:
          logEncoder: console
          logLevel: info
        metricsServer:
          logLevel: "0"
        operator:
          logEncoder: console
          logLevel: info
        watchNamespace: ""
      ```
      
      3. Verify logs in the kube-system namespace indicating `OwnerRefInvalidNamespace rolebinding/keda-auth-reader`
      
      ```
      $ oc get events -n kube-system|grep -i keda 4m51s       Warning   OwnerRefInvalidNamespace   rolebinding/keda-auth-reader   ownerRef [keda.sh/v1alpha1/KedaController, namespace: kube-system, name: keda, uid: 1e9a6cd3-17e8-4dec-832f-64ab6db759fe] does not exist in namespace "kube-system" ... 
      ```
      
      4. Confirm that the roledinding doesn't exist in the kube-system namespace:
      
      ```
      $ oc get rolebinding/keda-auth-reader -n kube-system
      Error from server (NotFound): rolebindings.rbac.authorization.k8s.io "keda-auth-reader" not found
      ```

      Actual results:

      Observed OwnerRefInvalidNamespace in the kube-system namespace 
      
      ```
      $ oc get events -n kube-system|grep -i keda 4m51s       Warning   OwnerRefInvalidNamespace   rolebinding/keda-auth-reader   ownerRef [keda.sh/v1alpha1/KedaController, namespace: kube-system, name: keda, uid: 1e9a6cd3-17e8-4dec-832f-64ab6db759fe] does not exist in namespace "kube-system" ...
      ```

      Expected results:

      Not errors

      Additional info:

       

      Attachments

        Activity

          People

            joelsmith.redhat Joel Smith
            rhn-support-ocasalsa Oscar Casal Sanchez
            Weinan Liu Weinan Liu
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: