Bug 1357248 - Some serviceaccounts are delayed to create after project created
Summary: Some serviceaccounts are delayed to create after project created
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.2.1
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 3.2.1
Assignee: Jordan Liggitt
QA Contact: weiwei jiang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-17 08:07 UTC by Bardi Harborow
Modified: 2017-02-23 00:54 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1324179
Environment:
Last Closed: 2016-07-27 19:08:59 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Bardi Harborow 2016-07-17 08:07:41 UTC
#1324179 has regressed.

After waiting for quota reconciliation (see #1351705), and then creating a new jenkins quickstart, I get this:

Error creating deployer pod for bardiharborow-2ec23007/jenkins-1: pods "jenkins-1-deploy" is forbidden: no API token found for service account bardiharborow-2ec23007/deployer, retry after the token is automatically created and added to the service account

Comment 1 Jordan Liggitt 2016-07-18 01:40:27 UTC
How long did it take for the quota to reconcile?

Comment 2 Jordan Liggitt 2016-07-18 01:41:40 UTC
And can you include the output of the following commands:

oc get sa -o yaml
oc get secrets -o name

Comment 3 Douglas Edgar 2016-07-19 23:19:14 UTC
Related to #1324179.

A user reported an error occurred in preview while trying to create a cakephp-no-database application: "Cannot create service "insomniatest3". services "insomniatest3" is forbidden: Status unknown for quota: object-counts"

Here's the requested command output for the project:

[root@preview-master-e69da ~]# oc get sa -o yaml -n insomniatest3
apiVersion: v1
items:
- apiVersion: v1
  imagePullSecrets:
  - name: builder-dockercfg-kw3xn
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:25Z
    name: builder
    namespace: insomniatest3
    resourceVersion: "55536108"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/builder
    uid: acb8e910-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: builder-dockercfg-kw3xn
  - name: builder-token-74738
- apiVersion: v1
  imagePullSecrets:
  - name: default-dockercfg-ulur7
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:25Z
    name: default
    namespace: insomniatest3
    resourceVersion: "55536101"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/default
    uid: ac9be52e-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: default-dockercfg-ulur7
  - name: default-token-necec
- apiVersion: v1
  imagePullSecrets:
  - name: deployer-dockercfg-l45dc
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:26Z
    name: deployer
    namespace: insomniatest3
    resourceVersion: "55536113"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/deployer
    uid: acd2d5b4-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: deployer-dockercfg-l45dc
  - name: deployer-token-7r155
kind: List
metadata: {}

[root@preview-master-e69da ~]# oc get secrets -o name -n insomniatest3
secret/builder-dockercfg-kw3xn
secret/builder-token-66b1r
secret/builder-token-74738
secret/default-dockercfg-ulur7
secret/default-token-5937g
secret/default-token-necec
secret/deployer-dockercfg-l45dc
secret/deployer-token-7r155
secret/deployer-token-xbxug
[root@preview-master-e69da ~]#

Comment 4 Jordan Liggitt 2016-07-19 23:24:34 UTC
The quota issue is https://bugzilla.redhat.com/show_bug.cgi?id=1351705

This is possibly a secondary issue after quota reconciles

I need to know the timing at work here (how long did quota take to reconcile), and what is he current state of the project, which is why I need the requested output.

Comment 5 Jordan Liggitt 2016-07-27 19:08:59 UTC
1351705 was resolved, unable to recreate this


Note You need to log in before you can comment on or make changes to this bug.