Bug 1774907 - continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver
Summary: continuous "cannot list resource "endpoints\services\pods" error for openshif...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: openshift-apiserver
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.3.0
Assignee: Stefan Schimanski
QA Contact: Junqi Zhao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-21 09:35 UTC by Junqi Zhao
Modified: 2020-01-23 11:13 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-01-23 11:13:36 UTC
Target Upstream Version:


Attachments (Terms of Use)
continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver (944.79 KB, text/plain)
2019-11-21 09:35 UTC, Junqi Zhao
no flags Details


Links
System ID Priority Status Summary Last Updated
Github openshift cluster-openshift-apiserver-operator pull 262 'None' closed Bug 1774907: fix ns for prometheus-k8s rolebinding 2020-06-01 19:36:54 UTC
Red Hat Product Errata RHBA-2020:0062 None None None 2020-01-23 11:13:54 UTC

Description Junqi Zhao 2019-11-21 09:35:33 UTC
Created attachment 1638375 [details]
continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver

continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver
OCP 4.3/openshift-apiserver
m/m

Description of problem:
# oc -n openshift-monitoring logs -c prometheus prometheus-k8s-0 | grep "openshift-apiserver"
there are continuous "cannot list resource **" in API group \"\" in the namespace \"openshift-apiserver\", example:
level=error ts=2019-11-21T01:54:08.919Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:263: Failed to list *v1.Endpoints: endpoints is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"endpoints\" in API group \"\" in the namespace \"openshift-apiserver\""
level=error ts=2019-11-21T02:04:04.374Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:265: Failed to list *v1.Pod: pods is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"pods\" in API group \"\" in the namespace \"openshift-apiserver\""
level=error ts=2019-11-21T02:02:53.069Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:264: Failed to list *v1.Service: services is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"services\" in API group \"\" in the namespace \"openshift-apiserver\""
*********************************************
But the endpoints are all normal from API search
# oc -n openshift-apiserver get ep
NAME   ENDPOINTS                                            AGE
api    10.128.0.32:8443,10.129.0.30:8443,10.130.0.33:8443   7h10m

# token=`oc -n openshift-monitoring sa get-token prometheus-k8s`
# oc -n openshift-monitoring exec -c prometheus prometheus-k8s-1  -- curl -k -H "Authorization: Bearer $token" 'https://10.128.0.32:8443/metrics'
...
apiserver_admission_controller_admission_duration_seconds_bucket{name="MutatingAdmissionWebhook",operation="CREATE",rejected="false",type="admit",le="0.005"} 88
apiserver_admission_controller_admission_duration_seconds_bucket{name="MutatingAdmissionWebhook",operation="CREATE",rejected="false",type="admit",le="0.025"} 88
...
watched, api-server is not stable, at first it can't list endpoints, but then it can list endpoints
# token=`oc -n openshift-monitoring sa get-token prometheus-k8s`
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
no
# oc auth can-i list endpoints -n openshift-apiserver --token $token
yes
# oc auth can-i list endpoints -n openshift-apiserver --token $token
yes

Version-Release number of selected component (if applicable):
4.3.0-0.nightly-2019-11-20-225457

How reproducible:
Recently

Steps to Reproduce:
1. oc -n openshift-monitoring logs -c prometheus prometheus-k8s-0 | grep "openshift-apiserver"
2.
3.

Actual results:
continuous "cannot list resource "endpoints\services\pods" erro

Expected results:
Should not have such error

Additional info:

Comment 4 errata-xmlrpc 2020-01-23 11:13:36 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0062


Note You need to log in before you can comment on or make changes to this bug.