Bug 1854636

Summary:	Restore fails with 'TemplateInstance.template.openshift.io is invalid: spec.requester.username: Forbidden: you do not have permission to set username
Product:	OpenShift Container Platform	Reporter:	John Matthews <jmatthew>
Component:	Migration Tooling	Assignee:	Erik Nelson <ernelson>
Status:	CLOSED ERRATA	QA Contact:	Xin jiang <xjiang>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	4.4	CC:	chezhang, mberube, rjohnson, sregidor, whu, wsun
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-05 10:51:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description John Matthews 2020-07-07 19:34:53 UTC

Description of problem:

On Restore of some namespaces we have seen reports of:

Reconcile failed: [TemplateInstance.template.openshift.io "ec809a22-a9c5-11ea-8463-0a580a80006a" is invalid: spec.requester.username: Forbidden: you do not have permission to set username]

Still working on details of recreating, this may be related to applications deployed via ServiceCatalog + TemplateBroker on source cluster, or may be from server side processing an OpenShift template.

Comment 2 Erik Nelson 2020-07-16 16:59:41 UTC

https://github.com/konveyor/mig-operator/pull/379

Comment 5 Sergio 2020-07-21 14:27:24 UTC

Verified using CAM 1.2.4 stage. OCP 3.11 -> OCP 4.4 with AWS S3


openshift-migration-rhel7-operator@sha256:540ece2453575615cf1447d1b6faeca312d363a56de966a4c29f6a0c24d66f2b

In order to verify this BZ we have migrated:

- a persistent django application deployed with a template instance from the catalog UI
- a manually created template instance with the template embeded

In both cases the migration worked fine, the applications were migrated and the template instances ignored. 


A warning because of the GVK occurs because of service catalog when the template instance is from the catalog UI, but this warning is expected and the service catalog is ignored too.

    incompatibleNamespaces:
    - gvks:
      - group: servicecatalog.k8s.io
        kind: serviceinstances
        version: v1beta1

Comment 7 errata-xmlrpc 2020-08-05 10:51:25 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Cluster Application Migration (CAM) Tool Image Release Advisory 1.2.4), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3320