Bug 1745963

Summary: Problems with service account in the controller
Product: OpenShift Container Platform Reporter: Sergio <sregidor>
Component: Migration ToolingAssignee: Jason Montleon <jmontleo>
Status: CLOSED ERRATA QA Contact: Zhang Cheng <chezhang>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.2.0CC: chezhang, dwhatley, jmatthew, jmontleo, rpattath, xjiang
Target Milestone: ---   
Target Release: 4.2.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-10-16 06:37:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sergio 2019-08-27 10:34:48 UTC 
Description of problem:

The app migration tool fails with the error

E0827 09:06:23.743543       1 reflector.go:134] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:196: Failed to list *v1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:openshift-migration-operator:migration-controller" cannot list resource "deployments" in API group "apps" at the cluster scope



Version-Release number of selected component (if applicable):

OCP3:

# oc version
oc v3.9.97
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://XXXXXXXXXXXXXXX
openshift v3.9.97
kubernetes v1.9.1+a0ce1bc657

OCP4

# oc get clusterversion
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.2.0-0.nightly-2019-08-26-235330   True        False         3h9m    Cluster version is 4.2.0-0.nightly-2019-08-26-235330

Controller:
    image: quay.io/ocpmigrate/mig-controller:stable
    imageID: quay.io/ocpmigrate/mig-controller@sha256:dda76bd4de888f9bc3731a71e6ff70f83a4551386a29f02391bad5feb9cb336d

Velero:
    image: quay.io/ocpmigrate/velero:stable
    imageID: quay.io/ocpmigrate/velero@sha256:957725dec5f0fb6a46dee78bd49de9ec4ab66903eabb4561b62ad8f4ad9e6f05
    image: quay.io/ocpmigrate/migration-plugin:stable
    imageID: quay.io/ocpmigrate/migration-plugin@sha256:b4493d826260eb1e3e02ba935aaedfd5310fefefb461ca7dcd9a5d55d4aa8f35


How reproducible:


Steps to Reproduce:
1. The problem happens after some time running and migrating with the app migration tool

Actual results:

 The controller starts showing this error in its log:

E0827 09:29:49.100416       1 reflector.go:134] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:196: Failed to list *v1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:openshift-migration-operator:migration-controller" cannot list resource "deployments" in API group "apps" at the cluster scope


Expected results:

  There should be no problems in the controller.

Additional info:


It seems to be related with the deletion of the plans.  You can find extra information in

https://github.com/fusor/mig-controller/issues/275
https://github.com/fusor/mig-operator/pull/40
Comment 2 Xin jiang 2019-09-09 10:22:11 UTC 
I didn't see it was fixed in the comments. So changed its status to  ASSIGNED.
Comment 3 Sergio 2019-09-09 13:34:17 UTC 
Verified in 

Controller:
    image: quay.io/ocpmigrate/mig-controller:stable
    imageID: quay.io/ocpmigrate/mig-controller@sha256:7ec48a557240f1d2fa6ee6cd62234b0e75f178eca2a0cc5b95124e01bcd2c114
Velero:
    image: quay.io/ocpmigrate/velero:stable
    imageID: quay.io/ocpmigrate/velero@sha256:957725dec5f0fb6a46dee78bd49de9ec4ab66903eabb4561b62ad8f4ad9e6f05
    image: quay.io/ocpmigrate/migration-plugin:stable
    imageID: quay.io/ocpmigrate/migration-plugin@sha256:b4493d826260eb1e3e02ba935aaedfd5310fefefb461ca7dcd9a5d55d4aa8f35
OCP4:
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.2.0-0.nightly-2019-09-08-232045   True        False         123m    Cluster version is 4.2.0-0.nightly-2019-09-08-232045
OCP3:
oc v3.9.97
kubernetes v1.9.1+a0ce1bc657


This failure is not in controller's logs anymore after deleting migration plans.
Comment 4 errata-xmlrpc 2019-10-16 06:37:54 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922