Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-36833

4.16 "Bad" reconciliation loops can cause unbounded dockercfg secret creation

XMLWordPrintable

    • Critical
    • Yes
    • False
    • Hide

      None

      Show
      None

      Description of problem:

      In 4,16 OCP starts to place an annotation on service accounts when it creates a dockercfg secret. Some operators/reconciliation loops (incorrectly) will then try to set the annotation on the SA back to exactly what they wanted. OCP will annotate again and create a new secret. Operators sets it back without annotation. Rinse Repeat.
      
      Eventually etcd will get completely overloaded with secrets, will start to OOM, and the entire cluster will come down.

       

      There is belief that at least otel, tempo, acm, odf/ocs, strymzi, elasticsearch and possibly other operators reconciled the annoations on the SA by setting them back exactly how they wanted them set.

       

      These seem to be related (but no complete)

      https://issues.redhat.com/browse/LOG-5776

      https://issues.redhat.com/browse/ENTMQST-6129

      https://issues.redhat.com/browse/TRACING-4435

      https://issues.redhat.com/browse/ACM-10987

            lusanche@redhat.com Luis Sanchez
            eparis@redhat.com Eric Paris
            Rahul Gangwar Rahul Gangwar
            Votes:
            2 Vote for this issue
            Watchers:
            30 Start watching this issue

              Created:
              Updated:
              Resolved: