Bug 1953185

Summary:	[Azure disk csi dirver operator] doesn't use the credential created by CCO
Product:	OpenShift Container Platform	Reporter:	Qin Ping <piqin>
Component:	Storage	Assignee:	Jan Safranek <jsafrane>
Storage sub component:	Operators	QA Contact:	Wei Duan <wduan>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	medium
Priority:	unspecified	CC:	aos-bugs, fbertina, jsafrane
Version:	4.8
Target Milestone:	---
Target Release:	4.9.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-18 17:30:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Qin Ping 2021-04-24 13:13:42 UTC

Description of problem:
Azure disk csi dirver operator doesn't use the credential created by CCO

Version-Release number of selected component (if applicable):
4.8.0-0.nightly-2021-04-22-182303

How reproducible:
Always

Steps to Reproduce:
1. Check the credentialrequst, no credential request fore azure disk csi driver operator.
$ oc get credentialsrequests.cloudcredential.openshift.io -A
NAMESPACE                             NAME                                           AGE
openshift-cloud-credential-operator   aws-ebs-csi-driver-operator                    10h
openshift-cloud-credential-operator   cloud-credential-operator-gcp-ro-creds         10h
openshift-cloud-credential-operator   cloud-credential-operator-iam-ro               10h
openshift-cloud-credential-operator   manila-csi-driver-operator                     10h
openshift-cloud-credential-operator   openshift-cluster-csi-drivers                  10h
openshift-cloud-credential-operator   openshift-gcp-pd-csi-driver-operator           10h
openshift-cloud-credential-operator   openshift-image-registry                       10h
openshift-cloud-credential-operator   openshift-image-registry-azure                 10h
openshift-cloud-credential-operator   openshift-image-registry-gcs                   10h
openshift-cloud-credential-operator   openshift-image-registry-openstack             10h
openshift-cloud-credential-operator   openshift-ingress                              10h
openshift-cloud-credential-operator   openshift-ingress-azure                        10h
openshift-cloud-credential-operator   openshift-ingress-gcp                          10h
openshift-cloud-credential-operator   openshift-machine-api-aws                      10h
openshift-cloud-credential-operator   openshift-machine-api-azure                    10h
openshift-cloud-credential-operator   openshift-machine-api-gcp                      10h
openshift-cloud-credential-operator   openshift-machine-api-kubevirt                 10h
openshift-cloud-credential-operator   openshift-machine-api-openstack                10h
openshift-cloud-credential-operator   openshift-machine-api-ovirt                    10h
openshift-cloud-credential-operator   openshift-machine-api-vsphere                  10h
openshift-cloud-credential-operator   openshift-network                              10h
openshift-cloud-credential-operator   openshift-vmware-vsphere-csi-driver-operator   10h
openshift-cloud-credential-operator   openshift-vsphere-problem-detector             10h
openshift-cloud-credential-operator   ovirt-csi-driver-operator                      10h

2. Check controller pod
2021-04-23T05:25:44.210777148Z W0423 05:25:44.210709       1 azure_config.go:51] Failed to get cloud-config from secret: failed to get secret azure-cloud-provider: secrets "azure-cloud-provider" not found, skip initializing from secret

3. Check driver node pod
2021-04-23T03:18:32.191494431Z W0423 03:18:32.191401       1 azure_config.go:51] Failed to get cloud-config from secret: failed to get secret azure-cloud-provider: secrets "azure-cloud-provider" is forbidden: User "system:serviceaccount:openshift-cluster-csi-drivers:azure-disk-csi-driver-node-sa" cannot get resource "secrets" in API group "" in the namespace "kube-system", skip initializing from secret


Actual results:


Expected results:

Master Log:

Node Log (of failed PODs):

PV Dump:

PVC Dump:

StorageClass Dump (if StorageClass used by PV/PVC):

Additional info:

Comment 1 Fabio Bertinatto 2021-04-27 08:08:25 UTC

The team discussed this and agreed that the current behavior is OK for Tech Preview (4.8).

We'll revisit this before the driver & operator moves to GA.

Comment 2 Fabio Bertinatto 2021-04-27 08:09:08 UTC

For reference, this is the Jira card: https://issues.redhat.com/browse/STOR-569

Comment 3 Fabio Bertinatto 2021-08-20 14:29:08 UTC

*** Bug 1994690 has been marked as a duplicate of this bug. ***

Comment 4 Jan Safranek 2021-08-31 09:37:17 UTC

I'm fixing it as part of Azure Stack Hub fixes in https://bugzilla.redhat.com/show_bug.cgi?id=1992875

Comment 5 Jan Safranek 2021-09-07 11:38:11 UTC

Putting to ON_QA, fix for bug #1992875 has been merged to OCP 4.9. The fix is the same for this BZ, but keeping this BZ open for re-test on a regular Azure Cloud cluster.

Comment 8 Wei Duan 2021-09-08 06:22:57 UTC

Verified pass on 4.9.0-0.nightly-2021-09-07-201519

$ oc get credentialsrequests.cloudcredential.openshift.io -n openshift-cloud-credential-operator azure-disk-csi-driver-operator -o yaml
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
...
  name: azure-disk-csi-driver-operator
  namespace: openshift-cloud-credential-operator
...
spec:
...
  secretRef:
    name: azure-disk-credentials
    namespace: openshift-cluster-csi-drivers

Comment 11 errata-xmlrpc 2021-10-18 17:30:14 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.9.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:3759