Verified with OCP build 4.4.0-0.nightly-2020-02-03-005212.
Verification steps referring to the code changes from PR https://github.com/openshift/cluster-kube-apiserver-operator/pull/629
1. Check the apiserver pods information,
$ apiserver_pod=$(oc get po -n openshift-kube-apiserver | grep kube-apiserver | awk '{print $1}' | head -1)
$ oc get po $apiserver_pod -n openshift-kube-apiserver -o json | jq .spec.initContainers[0].securityContext
{
"privileged": true
}
$ oc get po $apiserver_pod -n openshift-kube-apiserver -o json | jq .spec.containers[0].securityContext
{
"privileged": true
}
The containers' securityContext were changed.
2. Check if the related error ‘failed to tryAcquireOrRenew’ can be found,
$ apiserver_node=$(oc get po -o wide -n openshift-kube-apiserver | grep kube-apiserver | awk '{print $7}' | head -1)
$ oc debug node/$apiserver_node
After logged in the debug pod of the apiserver node ,
sh-4.2# chroot /host
sh-4.4# grep -r 'failed to tryAcquireOrRenew' /var/log/pods/<openshift-kube-apiserver_kube-apiserver node>
Not found the related error ‘failed to tryAcquireOrRenew’ .
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2020:0581