Erez, Mooli can you look at this? I have the feeling that there may be missing permissions in the above cluster.


FYI this error is just for information, it's not critical (nor related to SmartState):

[----] E, [2016-08-30T13:14:07.329208 #11710:5c5990] ERROR -- : Unexpected Exception during refresh: HTTP status code 403, User "system:serviceaccount:management-infra:management-admin" cannot list all componentstatuses in the cluster

Parasad, I would like to see that we have cluster-reader permissions on the cluster (Per Federico's comment that this might be a missing permissions problem) Can you access the Openshift cluster? 
How was the manageiq account set up?

Is management-infra/management-admin in the output of the command:
oc get clusterrolebinding cluster-readers

Do we have the image-auditor / image-puller permission?
oc get clusterrolebinding system:image-auditor
oc get clusterrolebinding system:image-puller
(do the container management-infra/inspector-admin and management-infra/management-admin ?)

Thank you

Hello Erez,

Here are the commands output: 

# oc get clusterrolebinding cluster-readers -o yaml
apiVersion: v1
groupNames:
- system:cluster-readers
kind: ClusterRoleBinding
metadata:
  creationTimestamp: 2016-04-04T14:53:17Z
  name: cluster-readers
  resourceVersion: "6193113"
  selfLink: /oapi/v1/clusterrolebindings/cluster-readers
  uid: f6ead8e0-fa74-11e5-b316-005056950deb
roleRef:
  name: cluster-reader
subjects:
- kind: ServiceAccount
  name: management-admin
  namespace: management-infra
- kind: ServiceAccount
  name: heapster
  namespace: openshift-infra
- kind: SystemUser
  name: system:serviceacccount:openshift-infra:heapster
- kind: ServiceAccount
  name: aggregated-logging-fluentd
  namespace: testmn
- kind: User
  name: U443666
- kind: User
  name: U410976
- kind: ServiceAccount
  name: cfme
  namespace: management-infra
- kind: SystemGroup
  name: system:cluster-readers
userNames:
- system:serviceaccount:management-infra:management-admin
- system:serviceaccount:openshift-infra:heapster
- system:serviceacccount:openshift-infra:heapster
- system:serviceaccount:testmn:aggregated-logging-fluentd
- U443666
- U410976
- system:serviceaccount:management-infra:cfme

-------------------------------------------------------------------------------------

# oc get clusterrolebinding system:image-auditor -o yaml
apiVersion: v1
groupNames: null
kind: ClusterRoleBinding
metadata:
  creationTimestamp: 2016-07-12T09:37:39Z
  name: system:image-auditor
  resourceVersion: "6193234"
  selfLink: /oapi/v1/clusterrolebindings/system:image-auditor
  uid: 4627884e-4814-11e6-8554-005056950deb
roleRef:
  name: system:image-auditor
subjects:
- kind: ServiceAccount
  name: management-admin
  namespace: management-infra
userNames:
- system:serviceaccount:management-infra:management-admin

-------------------------------------------------------------------------------------

# oc get clusterrolebinding system:image-puller -o yaml
apiVersion: v1
groupNames:
- system:authenticated
kind: ClusterRoleBinding
metadata:
  creationTimestamp: 2016-04-06T12:08:47Z
  name: system:image-puller
  resourceVersion: "6193236"
  selfLink: /oapi/v1/clusterrolebindings/system:image-puller
  uid: 50d63054-fbf0-11e5-9719-005056950deb
roleRef:
  name: system:image-puller
subjects:
- kind: ServiceAccount
  name: inspector-admin
  namespace: management-infra
- kind: SystemGroup
  name: system:authenticated
userNames:
- system:serviceaccount:management-infra:inspector-admin

Service Account was created by referring following documentation :

https://access.redhat.com/documentation/en/red-hat-cloudforms/4.0/managing-providers/chapter-3-containers-providers

Let us know if any additional information needed.

Can we get the logs please? 
Was this working at some point and stopped? never worked?

No it's not missing, We've already checked that.

 #oc get clusterrole management-infra-admin -o yaml
apiVersion: v1
kind: ClusterRole
metadata:
  creationTimestamp: 2016-04-05T07:06:38Z
  name: management-infra-admin
  resourceVersion: "50"
  selfLink: /oapi/v1/clusterroles/management-infra-admin
  uid: f119c760-fafc-11e5-8ab9-00505695658d
rules:
- apiGroups: null
  attributeRestrictions: null
  resources:
  - pods/proxy
  verbs:
  - '*'

Created attachment 1204775 [details]
master-config

This is most likely a proxy misconfiguration, please read:

https://docs.openshift.com/container-platform/3.4/install_config/install/advanced_install.html#advanced-install-configuring-global-proxy

And the relevant configuration file is:

/etc/sysconfig/atomic-openshift-master

Where you can configure the NO_PROXY parameter to reach the nodes.

Please let us know if comment 37 addressed the issue.

Sachin,
Using input from a similar BZ I made a PR [1] that I think might also fix your problem.


[1]https://github.com/ManageIQ/manageiq/pull/14578

Erez, Should this be move to POST?

Mooli,
I assumed that this issue is caused by something similar to [1] which is fixed by [2]. We need more details to be sure that this is indeed solved now.

[1]https://bugzilla.redhat.com/show_bug.cgi?id=1384629
[2]https://github.com/ManageIQ/manageiq/pull/14578

reverting needinfo removed by mistake(See comment 38)

We should consider closing this one on insufficient data as it has an unanswered needinfo since 2017-02-28.