| Summary: | [networking_public_53] Error about "unable to find namespaces for router" appears in the router log when adding the NAMESPACE_LABELS to the router | ||
|---|---|---|---|
| Product: | OKD | Reporter: | Meng Bo <bmeng> |
| Component: | Routing | Assignee: | Phil Cameron <pcameron> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | zhaozhanqi <zzhao> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.x | CC: | aloughla, aos-bugs, atragler, mleitner, ramr, rkhan |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-12-09 21:50:21 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Meng Bo
2016-05-03 11:12:05 UTC
The error is because the User "system:serviceaccount:default:router" cannot list all namespaces in the cluster. You will need to give permissions to the default service account to do that. Ala: $ oadm policy add-cluster-role-to-user cluster-reader system:serviceaccount:default:router And if you run the router with namespace/project labels: $ oadm router ... $ oc env dc/router NAMESPACE_LABELS="router=r1" Example test: $ oc label namespace default "router=r1" $ # create routes in default namespace. $ # example oc create -f route1.yaml $ echo "route1 should be available via the router" $ oc new-project p1 $ # create routes in project p1 $ # and these should not show up $ # example oc create -f route2.yaml $ echo "route2 should not be available via the router" If you now label namespace p1 with "router=r1" ala: $ oc label namespace p1 "router=r1" the routes should show up in the router. Note that removing the label the namespace won't have immediate effect (as we don't see the updates in the router), so if you redeploy/start a new router pod, you should see the unlabelled effects. Ala: $ oc scale dc/router --replicas=0 && oc scale dc/router --replicas=1 @ramr Thanks for the instruction. I know the errors must be caused by some permission issues. But I did not find it in any of our docs or the client output or the router logs. I think this is a bug since we should let user know that he has to do the step oadm policy add-cluster-role-to-user to make the NAMESPACE_LABELS works. Just like when the oadm router failed at the first time, it will guide the user to add the service account router to the hostnetwork privileged scc group. And it is more better if we can do it automatically when creating the router. Like we create the service account router and the cluster-rolebinding router-router-role. @bmengm I guess we can update docs for this release and add to the default set of permissions on the router service account in the next release. Does that sound good? The docs are still in the midst of getting written, so bear with us for a bit. Thx @ramr Thanks, I think we should at least make it described clearly in documents. openshift-docs PR2199 address this. Looking for feedback. Ben Bennet, Ram R, tnguyen-rh, all provided feedback on the doc changes. I made the changes and it is back out for review. Please feel free to review the changes on github. Commit pushed to master at https://github.com/openshift/openshift-docs https://github.com/openshift/openshift-docs/commit/3c1d243c064978eaf607cde689da89d2235ff446 Merge pull request #2199 from pecameron/bz1332510 bz1332510 - unable to find namespaces for router fixes bug 1332510 Close this bug since the doc has been updated. |