After doing oadm policy "add-cluster-role-to-user cluster-admin system:serviceaccount:logging:logging-deployer" on the master machine,logging deployer pod got completed successfully. Checked logging docs at https://docs.openshift.org/latest/install_config/aggregate_logging.html#pre-deployment-configuration, it is not updated. Will address the doc issue seperately, closing this issue as verified.
Origin code changed so that project editor (which is the deployer role) no longer can administer daemonsets. We actually do not want to make the deployer a cluster-admin due to security concerns of the cluster-admin token being on a node briefly; that's only something we'd recommend as a temporary fix to get past this. The long-term fix will be to add some custom roles to the deployer service account. That's coming with this PR: https://github.com/openshift/origin-aggregated-logging/pull/98/commits/7f8d77aacf790b21f302d23ea9bc29920e63940a Xia, if you have an origin issue to track this, or a docs issue, please note those here. I found some other errors in the docs that need fixing anyway, and will also queue up some doc fixes related to this change.
@lmeyer Thank you so much for the info. I have an OSE issue which has been proved to be the same root cause: https://bugzilla.redhat.com/show_bug.cgi?id=1321855 And a doc issue correspondingly: https://bugzilla.redhat.com/show_bug.cgi?id=1322249 BTW, I feel interested on "other errors in the docs that need fixing", hope to be updated with the material you will create here, would you please notify me in future when you are done and convenient? Thanks in advance!
@lmeyer Please also find another suspect issue for OSE 3.2: Logging deployer created logging-support-template in default namespace instead of the one specified for logging https://bugzilla.redhat.com/show_bug.cgi?id=1322245