Bug 2093393

Summary:	ovn-ipsec pods not rolling out in 4.11.0-0.nightly-2022-06-01-200905 - cannot delete CSR
Product:	OpenShift Container Platform	Reporter:	Mike Fiedler <mifiedle>
Component:	Networking	Assignee:	Mohammad Heib <mheib>
Networking sub component:	ovn-kubernetes	QA Contact:	Anurag saxena <anusaxen>
Status:	CLOSED DUPLICATE	Docs Contact:
Severity:	high
Priority:	unspecified	CC:	weliang
Version:	4.11	Keywords:	TestBlocker
Target Milestone:	---
Target Release:	4.11.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-06-07 13:01:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mike Fiedler 2022-06-03 15:16:09 UTC

Description of problem:

Installs of ipsec profiles are failing in 4.11.0-0.nightly-2022-06-01-200905 because the ovn-ipsec pods are not rolling out.   The error in the the ovn-keys container is:

++ hostname
+ kubectl delete --ignore-not-found=true csr/ip-10-0-62-21
Error from server (Forbidden): certificatesigningrequests.certificates.k8s.io "ip-10-0-62-21" is forbidden: User "system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-node" cannot delete resource "certificatesigningrequests" in API group "certificates.k8s.io" at the cluster scope


Version-Release number of selected component (if applicable): 4.11.0-0.nightly-2022-06-01-200905


How reproducible: Always for ipsec profiles


Additional info:   I will add must-gather location in a follow up comment

Comment 3 Mike Fiedler 2022-06-03 15:30:33 UTC

@mheib Assigning to you, please reassign if appropriate.

Comment 4 Weibin Liang 2022-06-03 15:51:47 UTC

Also failed in QE 4.11 e2e CI: https://mastern-jenkins-csb-openshift-qe.apps.ocp-c1.prod.psi.redhat.com/job/ocp-common/job/Flexy-install/108870/console and https://mastern-jenkins-csb-openshift-qe.apps.ocp-c1.prod.psi.redhat.com/job/ocp-common/job/Flexy-install/108819/console

Comment 5 Weibin Liang 2022-06-03 16:35:26 UTC

Same error and root cause as" https://bugzilla.redhat.com/show_bug.cgi?id=2091167#c1

Comment 6 Mike Fiedler 2022-06-07 13:01:04 UTC

ipsec profiles are installing ok now

*** This bug has been marked as a duplicate of bug 2091167 ***