-
Bug
-
Resolution: Done-Errata
-
Critical
-
4.15, 4.16
-
None
Description of problem:
Since OCP 4.15 we see issue with OLM deployed operator unable to operate in watched namespaces (multiple). It works fine with single watched namespace (subscription). Also, same test passes if we don't deploy operator using OLM, but using files. It seems like it is permission issue based on operator log. Same test works fine on any other previous OCP 4.14 and older.
Version-Release number of selected component (if applicable):
Server Version: 4.15.0-ec.3 Kubernetes Version: v1.28.3+20a5764
How reproducible:
Always
Steps to Reproduce:
0. oc login OCP4.15 1. git clone https://gitlab.cee.redhat.com/amq-broker/claire 2. make -f Makefile.downstream build ARTEMIS_VERSION=7.11.4 RELEASE_TYPE=released 3. make -f Makefile.downstream operator_test OLM_IIB=registry-proxy.engineering.redhat.com/rh-osbs/iib:636350 OLM_CHANNEL=7.11.x TESTS=ClusteredOperatorSmokeTests TEST_LOG_LEVEL=debug DISABLE_RANDOM_NAMESPACES=true
Actual results:
Can't deploy artemis broker custom resource in given namespace (permission issue - see details below)
Expected results:
Successfully deployed broker on watched namespaces
Additional info:
Log from AMQ Broker operator - seems like some permission issues since 4.15
E0103 10:04:54.425202 1 reflector.go:138] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: Failed to watch *v1beta1.ActiveMQArtemis: failed to list *v1beta1.ActiveMQArtemis: activemqartemises.broker.amq.io is forbidden: User "system:serviceaccount:cluster-tests:amq-broker-controller-manager" cannot list resource "activemqartemises" in API group "broker.amq.io" in the namespace "cluster-testsa" E0103 10:04:54.425207 1 reflector.go:138] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: Failed to watch *v1beta1.ActiveMQArtemisSecurity: failed to list *v1beta1.ActiveMQArtemisSecurity: activemqartemissecurities.broker.amq.io is forbidden: User "system:serviceaccount:cluster-tests:amq-broker-controller-manager" cannot list resource "activemqartemissecurities" in API group "broker.amq.io" in the namespace "cluster-testsa" E0103 10:04:54.425221 1 reflector.go:138] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: Failed to watch *v1.Pod: failed to list *v1.Pod: pods is forbidden: User "system:serviceaccount:cluster-tests:amq-broker-controller-manager" cannot list resource "pods" in API group "" in the namespace "cluster-testsa" W0103 10:04:54.425296 1 reflector.go:324] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: failed to list *v1beta1.ActiveMQArtemisScaledown: activemqartemisscaledowns.broker.amq.io is forbidden: User "system:serviceaccount:cluster-tests:amq-broker-controller-manager" cannot list resource "activemqartemisscaledowns" in API group "broker.amq.io" in the namespace "cluster-testsa"
- blocks
-
OCPBUGS-27435 [AMQ Broker Operator] OLM deployed operator with watching multiple namespaces can't deploy its resources
- Closed
- duplicates
-
OCPBUGS-27364 [4.15] Regression in multinamespace installation mode
- Closed
- is cloned by
-
OCPBUGS-27435 [AMQ Broker Operator] OLM deployed operator with watching multiple namespaces can't deploy its resources
- Closed
- relates to
-
ENTMQBR-8666 Failure in periodic-ci-rh-messaging-qe-claire-lpt-amq-broker-ocp4.15-lp-interop-amq-broker-interop-aws - - 12-18-2023
- Closed
- links to
-
RHEA-2024:0041 OpenShift Container Platform 4.16.z bug fix update
- mentioned on