Hide Forgot
Created attachment 1638375 [details] continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver continuous "cannot list resource "endpoints\services\pods" error for openshift-apiserver OCP 4.3/openshift-apiserver m/m Description of problem: # oc -n openshift-monitoring logs -c prometheus prometheus-k8s-0 | grep "openshift-apiserver" there are continuous "cannot list resource **" in API group \"\" in the namespace \"openshift-apiserver\", example: level=error ts=2019-11-21T01:54:08.919Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:263: Failed to list *v1.Endpoints: endpoints is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"endpoints\" in API group \"\" in the namespace \"openshift-apiserver\"" level=error ts=2019-11-21T02:04:04.374Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:265: Failed to list *v1.Pod: pods is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"pods\" in API group \"\" in the namespace \"openshift-apiserver\"" level=error ts=2019-11-21T02:02:53.069Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:264: Failed to list *v1.Service: services is forbidden: User \"system:serviceaccount:openshift-monitoring:prometheus-k8s\" cannot list resource \"services\" in API group \"\" in the namespace \"openshift-apiserver\"" ********************************************* But the endpoints are all normal from API search # oc -n openshift-apiserver get ep NAME ENDPOINTS AGE api 10.128.0.32:8443,10.129.0.30:8443,10.130.0.33:8443 7h10m # token=`oc -n openshift-monitoring sa get-token prometheus-k8s` # oc -n openshift-monitoring exec -c prometheus prometheus-k8s-1 -- curl -k -H "Authorization: Bearer $token" 'https://10.128.0.32:8443/metrics' ... apiserver_admission_controller_admission_duration_seconds_bucket{name="MutatingAdmissionWebhook",operation="CREATE",rejected="false",type="admit",le="0.005"} 88 apiserver_admission_controller_admission_duration_seconds_bucket{name="MutatingAdmissionWebhook",operation="CREATE",rejected="false",type="admit",le="0.025"} 88 ... watched, api-server is not stable, at first it can't list endpoints, but then it can list endpoints # token=`oc -n openshift-monitoring sa get-token prometheus-k8s` # oc auth can-i list endpoints -n openshift-apiserver --token $token no # oc auth can-i list endpoints -n openshift-apiserver --token $token no # oc auth can-i list endpoints -n openshift-apiserver --token $token no # oc auth can-i list endpoints -n openshift-apiserver --token $token no # oc auth can-i list endpoints -n openshift-apiserver --token $token yes # oc auth can-i list endpoints -n openshift-apiserver --token $token yes Version-Release number of selected component (if applicable): 4.3.0-0.nightly-2019-11-20-225457 How reproducible: Recently Steps to Reproduce: 1. oc -n openshift-monitoring logs -c prometheus prometheus-k8s-0 | grep "openshift-apiserver" 2. 3. Actual results: continuous "cannot list resource "endpoints\services\pods" erro Expected results: Should not have such error Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0062