Bug 1357248

Summary:	Some serviceaccounts are delayed to create after project created
Product:	OpenShift Container Platform	Reporter:	Bardi Harborow <bardi.harborow>
Component:	apiserver-auth	Assignee:	Jordan Liggitt <jliggitt>
Status:	CLOSED WORKSFORME	QA Contact:	weiwei jiang <wjiang>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	3.2.1	CC:	abhgupta, adellape, aos-bugs, bardi.harborow, bingli, dakini, deads, dedgar, haowang, jliggitt, pweil, trankin, wjiang, wsun, xiuwang
Target Milestone:	---
Target Release:	3.2.1
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1324179	Environment:
Last Closed:	2016-07-27 19:08:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Bardi Harborow 2016-07-17 08:07:41 UTC

#1324179 has regressed.

After waiting for quota reconciliation (see #1351705), and then creating a new jenkins quickstart, I get this:

Error creating deployer pod for bardiharborow-2ec23007/jenkins-1: pods "jenkins-1-deploy" is forbidden: no API token found for service account bardiharborow-2ec23007/deployer, retry after the token is automatically created and added to the service account

Comment 1 Jordan Liggitt 2016-07-18 01:40:27 UTC

How long did it take for the quota to reconcile?

Comment 2 Jordan Liggitt 2016-07-18 01:41:40 UTC

And can you include the output of the following commands:

oc get sa -o yaml
oc get secrets -o name

Comment 3 Douglas Edgar 2016-07-19 23:19:14 UTC

Related to #1324179.

A user reported an error occurred in preview while trying to create a cakephp-no-database application: "Cannot create service "insomniatest3". services "insomniatest3" is forbidden: Status unknown for quota: object-counts"

Here's the requested command output for the project:

[root@preview-master-e69da ~]# oc get sa -o yaml -n insomniatest3
apiVersion: v1
items:
- apiVersion: v1
  imagePullSecrets:
  - name: builder-dockercfg-kw3xn
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:25Z
    name: builder
    namespace: insomniatest3
    resourceVersion: "55536108"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/builder
    uid: acb8e910-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: builder-dockercfg-kw3xn
  - name: builder-token-74738
- apiVersion: v1
  imagePullSecrets:
  - name: default-dockercfg-ulur7
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:25Z
    name: default
    namespace: insomniatest3
    resourceVersion: "55536101"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/default
    uid: ac9be52e-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: default-dockercfg-ulur7
  - name: default-token-necec
- apiVersion: v1
  imagePullSecrets:
  - name: deployer-dockercfg-l45dc
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:26Z
    name: deployer
    namespace: insomniatest3
    resourceVersion: "55536113"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/deployer
    uid: acd2d5b4-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: deployer-dockercfg-l45dc
  - name: deployer-token-7r155
kind: List
metadata: {}

[root@preview-master-e69da ~]# oc get secrets -o name -n insomniatest3
secret/builder-dockercfg-kw3xn
secret/builder-token-66b1r
secret/builder-token-74738
secret/default-dockercfg-ulur7
secret/default-token-5937g
secret/default-token-necec
secret/deployer-dockercfg-l45dc
secret/deployer-token-7r155
secret/deployer-token-xbxug
[root@preview-master-e69da ~]#

Comment 4 Jordan Liggitt 2016-07-19 23:24:34 UTC

The quota issue is https://bugzilla.redhat.com/show_bug.cgi?id=1351705

This is possibly a secondary issue after quota reconciles

I need to know the timing at work here (how long did quota take to reconcile), and what is he current state of the project, which is why I need the requested output.

Comment 5 Jordan Liggitt 2016-07-27 19:08:59 UTC

1351705 was resolved, unable to recreate this