Uploaded image for project: 'OpenShift Pipelines'
  1. OpenShift Pipelines
  2. SRVKP-4268

reconcile a namespace again with missing rolebinding

    XMLWordPrintable

Details

    • Pipelines Sprint 261 TekShift, Pipelines Sprint TekShift 262

    Description

      https://github.com/tektoncd/operator/blob/8f8f425e1fa75ffdad726b56fba21bcdab803440/pkg/reconciler/openshift/tektonconfig/rbac.go#L260C1-L266C1

       

              // Now we're left with namespaces that have already been reconciled.
              // We must make sure that the default SCC is in force via the ClusterRole.
              sccRoleBinding, err := r.kubeClientSet.RbacV1().RoleBindings(ns.Name).Get(ctx, pipelinesSCCRoleBinding, metav1.GetOptions{})
              if err != nil {
                  return nil, err
              }
       

      in this section, we return an error if a "reconciled" namespace does not have the `pipelines-scc-rolebinding` - this acts as a verification and this errors leads to a false tektonconfig and a blocked reconcile loop stuck in a loop and hence a broken operator installation.

      piyushgarg001 has suggested that in this code snippet if the rolebinding does not exist, we should add the namespace back to reconciliation instead of bluntly returning the error - this will help in not-blocking the operator.

      Attachments

        Issue Links

          Activity

            People

              jkhelil jawed khelil
              concaf Shubham Minglani
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated: