Bug 1879159

Summary:	cluster-machine-approver is communicating with Kube API via localhost
Product:	OpenShift Container Platform	Reporter:	Lukasz Szaszkiewicz <lszaszki>
Component:	Cloud Compute	Assignee:	Alberto <agarcial>
Cloud Compute sub component:	Other Providers	QA Contact:	sunzhaohua <zhsun>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	high	CC:	jerzhang
Version:	4.6
Target Milestone:	---
Target Release:	4.6.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-27 16:41:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1863011, 1887354

Description Lukasz Szaszkiewicz 2020-09-15 14:43:59 UTC

Communicating with Kube API via localhost is discouraged because the caller doesn't know when the server is ready to serve the request. Reaching over the Kubernetes build-in service is preferred as it only contains the servers that are healthy and ready.

The following query shows that the operator frequently fails with errors like `127.0.0.1:6443: connect: connection refused` or `Failed to list *v1beta1.CertificateSigningRequest: certificatesigningrequests.certificates.k8s.io is forbidden: User "system:serviceaccount:openshift-cluster-machine-approver:machine-approver-sa" cannot list resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope`

[1] https://search.ci.openshift.org/?search=Failed+to+list+.*+is+forbidden%3A+.*+in+API+group&maxAge=48h&context=1&type=junit&name=&maxMatches=5&maxBytes=20971520&groupBy=job


I have opened https://github.com/openshift/cluster-machine-approver/pull/85 to address this issue.

Comment 1 Yu Qi Zhang 2020-09-15 15:16:30 UTC

The cluster-machine-approver is not part of the MCO, looking at the repo I think it might belong to machine-api? Moving over.

Comment 3 sunzhaohua 2020-09-27 07:56:36 UTC

Move to verified, didn't meet this in 4.6 version
https://search.ci.openshift.org/?search=Failed+to+list+.*+is+forbidden%3A+.*+in+API+group&maxAge=48h&context=1&type=junit&name=4.6&maxMatches=5&maxBytes=20971520&groupBy=job

Comment 6 errata-xmlrpc 2020-10-27 16:41:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4196