-
Bug
-
Resolution: Done
-
Critical
-
4.16
-
No
-
Rejected
-
False
-
-
Release Note Not Required
-
In Progress
Description of problem:
Migrate an OpenShift Cluster to Azure AD Workload Identity, it is not have sufficient permissions to apply the Azure Pod Identity webhook configuration.
Version-Release number of selected component (if applicable):
4.16
How reproducible:
Always
Steps to Reproduce:
1. According to the steps provided in the documentation: https://github.com/openshift/cloud-credential-operator/blob/master/docs/azure_workload_identity.md#steps-to-in-place-migrate-an-openshift-cluster-to-azure-ad-workload-identity 2. For step10. Failed to apply the azure pod identity webhook configuration.
Actual results:
For step10: [hmx@fedora CCO]$ oc replace -f ./CCO-456/output_dir/manifests/azure-ad-pod-identity-webhook-config.yaml Error from server (NotFound): error when replacing "./CCO-456/output_dir/manifests/azure-ad-pod-identity-webhook-config.yaml": secrets "azure-credentials" not found [hmx@fedora CCO]$ oc get po -n openshift-cloud-credential-operator NAME READY STATUS RESTARTS AGE cloud-credential-operator-594bf555b4-6srcq 2/2 Running 0 3h32m [hmx@fedora CCO]$ oc logs cloud-credential-operator-594bf555b4-6srcq -n openshift-cloud-credential-operator Defaulted container "kube-rbac-proxy" out of: kube-rbac-proxy, cloud-credential-operator Flag --logtostderr has been deprecated, will be removed in a future release, see https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components I0410 06:41:25.490507 1 kube-rbac-proxy.go:285] Valid token audiences: I0410 06:41:25.490752 1 kube-rbac-proxy.go:399] Reading certificate files I0410 06:41:25.491607 1 kube-rbac-proxy.go:447] Starting TCP socket on 0.0.0.0:8443 I0410 06:41:25.492241 1 kube-rbac-proxy.go:454] Listening securely on 0.0.0.0:8443 E0410 06:41:52.996659 1 webhook.go:154] Failed to make webhook authenticator request: Unauthorized E0410 06:41:52.997568 1 auth.go:47] Unable to authenticate the request due to an error: Unauthorized E0410 06:42:15.871706 1 webhook.go:154] Failed to make webhook authenticator request: Unauthorized E0410 06:42:15.871754 1 auth.go:47] Unable to authenticate the request due to an error: Unauthorized
Expected results:
Apply the azure pod identity webhook configuration successfully.
Additional info: