Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-38915

Creating CLI Manager Instance fails with RBAC errors

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.17.0
    • cli-manager
    • None
    • Important
    • None
    • 1
    • Workloads Sprint 259
    • 1
    • False
    • Hide

      None

      Show
      None
    • Release Note Not Required
    • In Progress

      Description of problem:

      creating cli manager instance fails with RBAC errors
      E0826 10:05:11.642536       1 target_config_reconciler.go:388] key failed with : clusterroles.rbac.authorization.k8s.io "openshift-cli-manager" is forbidden: user "system:serviceaccount:openshift-cli-manager-operator:openshift-cli-manager-operator" (groups=["system:serviceaccounts" "system:serviceaccounts:openshift-cli-manager-operator" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
      {APIGroups:["config.openshift.io"], Resources:["plugins/status"], Verbs:["create" "update" "patch" "get" "list" "watch"]}
      {APIGroups:["coordination.k8s.io"], Resources:["leases"], Verbs:["deletecollection"]}
          

      Version-Release number of selected component (if applicable):

           [knarra@knarra-thinkpadx1carbon7th ~]$ oc get csv -n openshift-cli-manager-operator
      NAME                          DISPLAY       VERSION   REPLACES   PHASE
      cli-manager-operator.v0.1.0   CLI Manager   0.1.0                Succeeded
      
          

      How reproducible:

          Always
          

      Steps to Reproduce:

          1. Install latest 4.17 OCP version
          2. Create catalogSource using the image registry-proxy.engineering.redhat.com/rh-osbs/iib@sha256:6960441ff1997bf2ed316da58ba77e99fddd51cd6b3c13548560f139de4594c0
          3. Browse to the operatorhub via console, create namespace openshift-cli-manager-operator, search for cli-manager-operator, click install, now create cli manager instance
          

      Actual results:

          cli manager instance does not show up under the openshift-cli-manager-operator namespace and error shown in the description are seen in the cli-manager-operator pod log.
      [knarra@knarra-thinkpadx1carbon7th ~]$ oc get pods -n openshift-cli-manager-operator
      NAME                                             READY   STATUS    RESTARTS   AGE
      openshift-cli-manager-operator-689b7cf49-lgkq5   1/1     Running   0          2m38s
          

      Expected results:

          No RBAC errors should be seen and cli manager instance should come up fine.
          

      Additional info:

          https://redhat-internal.slack.com/archives/GK58XC2G2/p1724666716327619
          

              aguclu@redhat.com Arda Guclu
              knarra@redhat.com Rama Kasturi Narra
              Rama Kasturi Narra Rama Kasturi Narra
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: