Uploaded image for project: 'OpenShift Pipelines'
  1. OpenShift Pipelines
  2. SRVKP-4268

reconcile a namespace again with missing rolebinding

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done
    • Icon: Critical Critical
    • Pipelines 1.15.0
    • None
    • Operator
    • None
    • Pipelines Sprint TekShift 1, Pipelines Sprint TekShift 2, Pipelines Sprint TekShift 3, Pipelines Sprint TekShift 4, Pipelines Sprint TekShift 5, Pipelines Sprint TekShift 6

      https://github.com/tektoncd/operator/blob/8f8f425e1fa75ffdad726b56fba21bcdab803440/pkg/reconciler/openshift/tektonconfig/rbac.go#L260C1-L266C1

       

              // Now we're left with namespaces that have already been reconciled.
        // We must make sure that the default SCC is in force via the ClusterRole.
        sccRoleBinding, err := r.kubeClientSet.RbacV1().RoleBindings(ns.Name).Get(ctx, pipelinesSCCRoleBinding, metav1.GetOptions{})
        if err != nil {
            return nil, err
        }

      in this section, we return an error if a "reconciled" namespace does not have the `pipelines-scc-rolebinding` - this acts as a verification and this errors leads to a false tektonconfig and a blocked reconcile loop stuck in a loop and hence a broken operator installation.

      piyushgarg001 has suggested that in this code snippet if the rolebinding does not exist, we should add the namespace back to reconciliation instead of bluntly returning the error - this will help in not-blocking the operator.

              jkhelil abdeljawed khelil
              concaf Shubham Minglani
              Piyush Garg Piyush Garg
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: