Created attachment 1638375[details]
continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver
continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver
OCP 4.3/openshift-apiserver
m/m
Description of problem:
# oc -n openshift-monitoring logs -c prometheus prometheus-k8s-0 | grep "openshift-apiserver"
there are continuous "cannot list resource **" in API group \"\" in the namespace \"openshift-apiserver\", example:
level=error ts=2019-11-21T01:54:08.919Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:263: Failed to list *v1.Endpoints: endpoints is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"endpoints\" in API group \"\" in the namespace \"openshift-apiserver\""
level=error ts=2019-11-21T02:04:04.374Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:265: Failed to list *v1.Pod: pods is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"pods\" in API group \"\" in the namespace \"openshift-apiserver\""
level=error ts=2019-11-21T02:02:53.069Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:264: Failed to list *v1.Service: services is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"services\" in API group \"\" in the namespace \"openshift-apiserver\""
*********************************************
But the endpoints are all normal from API search
# oc -n openshift-apiserver get ep
NAME ENDPOINTS AGE
api 10.128.0.32:8443,10.129.0.30:8443,10.130.0.33:8443 7h10m
# token=`oc -n openshift-monitoring sa get-token prometheus-k8s`
# oc -n openshift-monitoring exec -c prometheus prometheus-k8s-1 -- curl -k -H "Authorization: Bearer $token" 'https://10.128.0.32:8443/metrics'
...
apiserver_admission_controller_admission_duration_seconds_bucket{name="MutatingAdmissionWebhook",operation="CREATE",rejected="false",type="admit",le="0.005"} 88
apiserver_admission_controller_admission_duration_seconds_bucket{name="MutatingAdmissionWebhook",operation="CREATE",rejected="false",type="admit",le="0.025"} 88
...
watched, api-server is not stable, at first it can't list endpoints, but then it can list endpoints
# token=`oc -n openshift-monitoring sa get-token prometheus-k8s`
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
yes
# oc auth can-i list endpoints -n openshift-apiserver --token $token
yes
Version-Release number of selected component (if applicable):
4.3.0-0.nightly-2019-11-20-225457
How reproducible:
Recently
Steps to Reproduce:
1. oc -n openshift-monitoring logs -c prometheus prometheus-k8s-0 | grep "openshift-apiserver"
2.
3.
Actual results:
continuous "cannot list resource "endpoints\services\pods" erro
Expected results:
Should not have such error
Additional info:
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2020:0062