Bug 1951636

Summary:	assisted service operator use default serviceaccount in operator bundle
Product:	OpenShift Container Platform	Reporter:	Hao Liu <haoli>
Component:	assisted-installer	Assignee:	David Zager <dzager>
assisted-installer sub component:	Deployment Operator	QA Contact:	Chad Crum <ccrum>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	high	CC:	achernet, aos-bugs, asegurap, cbrant, cchun, ccrum, nshidlin
Version:	4.8	Keywords:	Triaged
Target Milestone:	---
Target Release:	4.8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	AI-Team-Platform
Fixed In Version:	OCP-Metal-v1.0.20.1	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-27 23:02:11 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Hao Liu 2021-04-20 15:42:20 UTC

Description of problem:
ACM is trying to integrate with the assisted installer operator by including the assisted installer operator into the ACM bundle 

during the bundle integration process we notice the following error 

```
Error: CSV is defining permissions for the default service account
Error: CSV deployment assisted-service-operator is using the default service account.
   Install deployment: assisted-service-operator
```

Version-Release number of selected component (if applicable):
version 0.0.2 in ocm-2.3 channel

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Chuck Brant 2021-05-04 15:56:22 UTC

Is there a place this work item is being tracked, as I don't see any updates inBX

Comment 3 nshidlin 2021-06-24 16:14:03 UTC

@haoli could you please provide some more information on how to reproduce this issue? thanks

Comment 4 Chad Crum 2021-07-07 13:47:20 UTC

@cchun - Do you have any idea how to reproduce this? I'm not sure how much longer Hao will be out.

Comment 5 David Zager 2021-07-07 14:00:23 UTC

@ccrum All you need to do is take a look at the infrastructure-operator's deployment to see what serviceaccount it's using (should be assisted-service). If you create an agentserviceconfig, the resulting assisted-service deployment should also be using assisted-service for it's serviceaccount.

Comment 7 Chad Crum 2021-07-13 13:50:02 UTC

This has been validated in 2.3.0-DOWNSTREAM-2021-07-12-15-34-40

Service account used by assisted service pod is assisted-service

[root@sealusa12 auth]# oc get pod assisted-service-549cb88686-jwvhf -o yaml | grep -i serviceaccount
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
  serviceAccount: assisted-service
  serviceAccountName: assisted-service
[root@sealusa12 auth]# oc get deployment infrastructure-operator -o yaml | grep -i serviceaccount
              fieldPath: spec.serviceAccountName
      serviceAccount: assisted-service
      serviceAccountName: assisted-service

Comment 10 errata-xmlrpc 2021-07-27 23:02:11 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438