Bug 2057403

Summary:	CMO logs show forbidden: User "system:serviceaccount:openshift-monitoring:cluster-monitoring-operator" cannot get resource "replicasets" in API group "apps" in the namespace "openshift-monitoring"
Product:	OpenShift Container Platform	Reporter:	Jayapriya Pai <janantha>
Component:	Monitoring	Assignee:	Simon Pasquier <spasquie>
Status:	CLOSED ERRATA	QA Contact:	hongyan li <hongyli>
Severity:	low	Docs Contact:
Priority:	low
Version:	4.11	CC:	amuller, anpicker, aos-bugs, spasquie
Target Milestone:	---
Target Release:	4.11.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-10 10:50:55 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2058148

Description Jayapriya Pai 2022-02-23 10:40:11 UTC

Description of problem:
CMO log shows following warning message which is not expected

```
oc logs cluster-monitoring-operator-667d4459f-cdnvd cluster-monitoring-operator
W0223 06:10:06.682008       1 client_config.go:617] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
W0223 06:10:07.738053       1 operator.go:313] unable to get owner reference (falling back to namespace): replicasets.apps "cluster-monitoring-operator-667d4459f" is forbidden: User "system:serviceaccount:openshift-monitoring:cluster-monitoring-operator" cannot get resource "replicasets" in API group "apps" in the namespace "openshift-monitoring"
```

Version-Release number of selected component (if applicable):

4.11

How reproducible:

Check logs for CMO from pod

Steps to Reproduce:
1. Check logs for CMO from pod

oc logs <cluster-monitoring-operator pod name> cluster-monitoring-operator -n openshift-monitoring

2.
3.

Actual results:

```
W0223 06:10:07.738053       1 operator.go:313] unable to get owner reference (falling back to namespace): replicasets.apps "cluster-monitoring-operator-667d4459f" is forbidden: User "system:serviceaccount:openshift-monitoring:cluster-monitoring-operator" cannot get resource "replicasets" in API group "apps" in the namespace "openshift-monitoring"
```

Expected results:

Warning should not be there

Additional info:

Comment 1 Brad Ison 2022-02-23 13:45:43 UTC

Posted a PR with a quick fix. Not seeing these warnings logged now:

$ kubectl -n openshift-monitoring logs --tail=-1 -l 'app=cluster-monitoring-operator' -c cluster-monitoring-operator  | grep -c 'unable to get owner'
0

Comment 3 Junqi Zhao 2022-02-24 09:21:55 UTC

reproduced with 4.11.0-0.nightly-2022-02-23-185405
# kubectl -n openshift-monitoring logs --tail=-1 -l 'app=cluster-monitoring-operator' -c cluster-monitoring-operator  | grep -c 'unable to get owner'
1
waiting for the PR merged to 4.11

Comment 6 hongyan li 2022-02-25 03:10:50 UTC

test with payload 4.11.0-0.nightly-2022-02-24-054925, no such error in the log

Comment 11 errata-xmlrpc 2022-08-10 10:50:55 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 4.11.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:5069