1707516 – MCO updates role bindings too frequently

Bug 1707516 - MCO updates role bindings too frequently

Summary: MCO updates role bindings too frequently

Keywords:
Status:	CLOSED DUPLICATE of bug 1703234
Alias:	None
Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Machine Config Operator
Sub Component:
Version:	4.1.0
Hardware:	Unspecified
OS:	Unspecified
Priority:	medium
Severity:	unspecified
Target Milestone:	---
Target Release:	---
Assignee:	Antonio Murdaca
QA Contact:	Micah Abbott
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2019-05-07 16:59 UTC by Mo
Modified:	2019-05-07 19:23 UTC (History)
CC List:	0 users
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2019-05-07 19:23:27 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Bugzilla	1706637	0	unspecified	CLOSED	RoleBindingRestriction being listed 4 times a second during e2e runs	2021-02-22 00:41:40 UTC

Description Mo 2019-05-07 16:59:30 UTC

Based on audit logs of a cluster that has been running for a day:

$ cat * | grep '"resource":"rolebindings"' | grep '"verb":"update"' | jq -r '.user.username+"\t->\t "+.objectRef.namespace+":"+.objectRef.name' | sort | uniq -c
   3577 system:serviceaccount:openshift-machine-config-operator:default	->	 default:machine-config-daemon-events
   3577 system:serviceaccount:openshift-machine-config-operator:default	->	 openshift-machine-config-operator:machine-config-daemon-events
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 default:prometheus-k8s
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 kube-system:prometheus-k8s
    321 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 kube-system:resource-metrics-auth-reader
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-apiserver:prometheus-k8s
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-cluster-version:prometheus-k8s
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-etcd:prometheus-k8s
    321 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-kube-controller-manager:prometheus-k8s
    321 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-kube-scheduler:prometheus-k8s
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-monitoring:prometheus-k8s
    320 system:serviceaccount:openshift-monitoring:cluster-monitoring-operator	->	 openshift-monitoring:prometheus-k8s-config
    210 system:serviceaccount:openshift-network-operator:default	->	 openshift-infra:openshift-sdn-controller-account
    210 system:serviceaccount:openshift-network-operator:default	->	 openshift-sdn:openshift-sdn-controller-leaderelection
    210 system:serviceaccount:openshift-network-operator:default	->	 openshift-sdn:prometheus-k8s

MCO is continuously updating two role bindings.  It should only update when the role binding is different than the expected value.

Comment 1 Antonio Murdaca 2019-05-07 19:23:27 UTC


*** This bug has been marked as a duplicate of bug 1703234 ***

Note You need to log in before you can comment on or make changes to this bug.