Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1787653

Summary: 4.2.8 -> 4.2.13 update has marketplace operator failing after: dial tcp 172.30.0.1:443: connect: no route to host
Product: OpenShift Container Platform Reporter: W. Trevor King <wking>
Component: NetworkingAssignee: Ben Bennett <bbennett>
Networking sub component: openshift-sdn QA Contact: zhaozhanqi <zzhao>
Status: CLOSED CURRENTRELEASE Docs Contact:
Severity: medium    
Priority: medium CC: dsover, scuppett
Version: 4.2.z   
Target Milestone: ---   
Target Release: 4.4.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-04 16:59:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description W. Trevor King 2020-01-03 21:16:34 UTC
One 4.2.8 -> 4.2.13 GCP CI job failed with [1]:

Jan  3 18:58:23.025: INFO: Unexpected error occurred: Cluster did not complete upgrade: timed out waiting for the condition: Could not update deployment "openshift-marketplace/marketplace-operator" (344 of 433)

The marketplace pod was crashlooping:

$ curl -s https://storage.googleapis.com/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/artifacts/e2e-gcp-upgrade/must-gather/quay-io-openshift-release-dev-ocp-v4-0-art-dev-sha256-335d7e63146bbd3bb903fb2fd1df042f450661e45be36cef89996badc29bbaf9/namespaces/openshift-marketplace/pods/marketplace-operator-7749fd48dd-4kfgp/marketplace-operator-7749fd48dd-4kfgp.yaml | yaml2json | jq .status.containerStatuses | json2yaml 
- containerID: cri-o://f89a2bdd6f659938c8b8b33abb15fa17a462a656f9aa41b1986b897d0970565b
  image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3ebed3396095ca7b47383a2e308b3a52ab871c2029a9ae9ad4a2d19051692fc5
  imageID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:3ebed3396095ca7b47383a2e308b3a52ab871c2029a9ae9ad4a2d19051692fc5
  lastState:
    terminated:
      containerID: cri-o://f89a2bdd6f659938c8b8b33abb15fa17a462a656f9aa41b1986b897d0970565b
      exitCode: '1'
      finishedAt: '2020-01-03T19:01:06Z'
      reason: Error
      startedAt: '2020-01-03T19:01:00Z'
  name: marketplace-operator
  ready: 'false'
  restartCount: '20'
  state:
    waiting:
      message: Back-off 5m0s restarting failed container=marketplace-operator pod=marketplace-operator-7749fd48dd-4kfgp_openshift-marketplace(857a7588-2e51-11ea-bb32-42010a000004)
      reason: CrashLoopBackOff

with no logs (either under lastState above or in the pod's must-gather directory [2]).  Cluster monitoring was pretty noisy, but here are the Degraded changes:

$ curl -s https://storage.googleapis.com/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/build-log.txt | grep 'changed Degraded'
Jan 03 17:49:44.887 E clusteroperator/network changed Degraded to True: ApplyOperatorConfig: Error while updating operator configuration: could not apply (/v1, Kind=ConfigMap) openshift-network-operator/applied-cluster: could not retrieve existing (/v1, Kind=ConfigMap) openshift-network-operator/applied-cluster: configmaps "applied-cluster" is forbidden: User "system:serviceaccount:openshift-network-operator:default" cannot get resource "configmaps" in API group "" in the namespace "openshift-network-operator": RBAC: [clusterrole.rbac.authorization.k8s.io "cluster-admin" not found, clusterrole.rbac.authorization.k8s.io "system:build-strategy-jenkinspipeline" not found, clusterrole.rbac.authorization.k8s.io "system:build-strategy-docker" not found, clusterrole.rbac.authorization.k8s.io "system:public-info-viewer" not found, clusterrole.rbac.authorization.k8s.io "system:oauth-token-deleter" not found, clusterrole.rbac.authorization.k8s.io "system:scope-impersonation" not found, clusterrole.rbac.authorization.k8s.io "basic-user" not found, clusterrole.rbac.authorization.k8s.io "system:openshift:public-info-viewer" not found, clusterrole.rbac.authorization.k8s.io "system:discovery" not found, clusterrole.rbac.authorization.k8s.io "system:basic-user" not found, clusterrole.rbac.authorization.k8s.io "system:openshift:discovery" not found, clusterrole.rbac.authorization.k8s.io "system:build-strategy-source" not found, clusterrole.rbac.authorization.k8s.io "system:webhook" not found, clusterrole.rbac.authorization.k8s.io "console-extensions-reader" not found, clusterrole.rbac.authorization.k8s.io "cluster-status" not found, clusterrole.rbac.authorization.k8s.io "self-access-reviewer" not found, clusterrole.rbac.authorization.k8s.io "system:image-puller" not found]
Jan 03 17:49:57.630 W clusteroperator/network changed Degraded to False
Jan 03 17:57:43.356 E clusteroperator/monitoring changed Degraded to True: UpdatingconfigurationsharingFailed: Failed to rollout the stack. Error: running task Updating configuration sharing failed: failed to retrieve Alertmanager host: getting Route object failed: the server was unable to return a response in the time allotted, but may still be processing the request (get routes.route.openshift.io alertmanager-main)
Jan 03 17:58:09.993 W clusteroperator/monitoring changed Degraded to False

So both network and monitoring operators tripped briefly into Degraded=True, but were back to Degraded=False for almost 3m (monitoring) or 10m (network) before the most-recent marketplace-operator container was launched at 19:01:00Z.  I'm not sure where to look for crashloop suspects without pod logs to go on, and I'm not comfortable enough with that cluster's health to know if the missing pod logs are because the marketplace-operator is too quiet or the cluster is unhealthy and losing the logs.

[1]: https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187
[2]: https://gcsweb-ci.svc.ci.openshift.org/gcs/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/artifacts/e2e-gcp-upgrade/must-gather/quay-io-openshift-release-dev-ocp-v4-0-art-dev-sha256-335d7e63146bbd3bb903fb2fd1df042f450661e45be36cef89996badc29bbaf9/namespaces/openshift-marketplace/pods/marketplace-operator-7749fd48dd-4kfgp/

Comment 1 W. Trevor King 2020-01-03 21:28:37 UTC
In this space are:

* Bug 1743699, about CA bundle injection.  But that was a 100% failure and a subsequent 4.2.8 -> 4.2.13 GCP CI job passed [1].
* Bug 1744153, about 4.1 marketplace operators vs. v2 CatalogSourceConfig.  But this bug is a 4.2->4.2 issue.
* Bug 1749643, about marketplace operators vs. non-hyphenated CatalogSourceConfig.  But the hyphen guard landed on 2019-09-12 [2], and 4.2.8 was cut on 2019-11-21, so it should include the fix.  Checking:

  $ oc adm release info --commits quay.io/openshift-release-dev/ocp-release:4.2.8 | grep marketplace
  operator-marketplace                          https://github.com/operator-framework/operator-marketplace                 906bffd1dea6464efd9d73d42f03d411ef6cb158
  $ git --no-pager log --oneline -18 origin/release-4.2 | sed 's/^/  /'
  2cc8e419 Merge pull request #272 from openshift-cherrypick-robot/cherry-pick-271-to-release-4.2
  ...
  906bffd1 Merge pull request #263 from Bowenislandsong/upgrade-status-bug-4.2
  ...
  77108b16 Merge pull request #249 from gallettilance/migration-bug-fix
  ...
  63fdd2cb [migration] - don't crash on non-hyphenated csc

  so we have the guard from that bug in 4.2.8.

[1]: https://prow.svc.ci.openshift.org/view/gcs/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/190
[2]: https://github.com/operator-framework/operator-marketplace/pull/249#event-2629670871

Comment 2 W. Trevor King 2020-01-03 21:30:55 UTC
[1] is pretty coarse, but has the marketplace-operator deployment breaking updates every few days.  It's possible that some of those hits have a different underlying cause.

[1]: https://search.svc.ci.openshift.org/?search=Could+not+update+deployment.*openshift-marketplace%2Fmarketplace-operator&maxAge=336h&context=-1&type=all

Comment 4 Stephen Cuppett 2020-01-07 13:42:20 UTC
Setting target to active development branch (4.4). Fixes (if any) will result in cloned BZs for backports (where required/requested) for prior versions.

Comment 6 W. Trevor King 2020-02-05 02:30:44 UTC
Huh.  Why does [1] have logs but [2] does not?

  $ curl -s https://storage.googleapis.com/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/artifacts/e2e-gcp-upgrade/must-gather/must-gather.log | grep 7749fd48dd
  [must-gather-hc9h5] POD 2020/01/03 19:04:06         Gathering data for pod "marketplace-operator-7749fd48dd-4kfgp"
  [must-gather-hc9h5] POD 2020/01/03 19:04:06         Skipping container data collection for pod "marketplace-operator-7749fd48dd-4kfgp": Pod not running
  [must-gather-hc9h5] OUT namespaces/openshift-marketplace/pods/marketplace-operator-7749fd48dd-4kfgp/
  [must-gather-hc9h5] OUT namespaces/openshift-marketplace/pods/marketplace-operator-7749fd48dd-4kfgp/marketplace-operator-7749fd48dd-4kfgp.yaml

I'll spin that off into a must-gather bug.

[1]: https://storage.googleapis.com/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/artifacts/e2e-gcp-upgrade/pods/openshift-marketplace_marketplace-operator-7749fd48dd-4kfgp_marketplace-operator.log
[2]: https://gcsweb-ci.svc.ci.openshift.org/gcs/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/artifacts/e2e-gcp-upgrade/must-gather/quay-io-openshift-release-dev-ocp-v4-0-art-dev-sha256-335d7e63146bbd3bb903fb2fd1df042f450661e45be36cef89996badc29bbaf9/namespaces/openshift-marketplace/pods/marketplace-operator-7749fd48dd-4kfgp/

Comment 7 W. Trevor King 2020-02-05 02:40:40 UTC
So from [1]:

time="2020-01-03T19:01:03Z" level=warning msg="Config API is not available"
time="2020-01-03T19:01:06Z" level=fatal msg="Get https://172.30.0.1:443/api?timeout=32s: dial tcp 172.30.0.1:443: connect: no route to host"

Sounds like bug 1715515, but that was closed as a dup of bug 1714699, which was verified fixed [2] in 4.2.0:

  $ curl -sH 'Accept:application/json' 'https://api.openshift.com/api/upgrades_info/v1/graph?channel=stable-4.2' | jq -r '.nodes[] | select(.metadata.url == "https://access.redhat.com/errata/RHBA-2019:2922").version'
  4.2.0

But moving to the networking folks so they try and diagnose.

[1]: https://storage.googleapis.com/origin-ci-test/logs/release-openshift-origin-installer-e2e-gcp-upgrade/187/artifacts/e2e-gcp-upgrade/pods/openshift-marketplace_marketplace-operator-7749fd48dd-4kfgp_marketplace-operator.log
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=1714699#c19

Comment 8 W. Trevor King 2020-02-05 21:58:42 UTC
(In reply to W. Trevor King from comment #6)
> I'll spin that off into a must-gather bug.

Filed as bug 1798753.

Comment 9 Ben Bennett 2020-03-04 16:59:57 UTC
I'm not seeing this happen recently.  Please reopen if I am wrong.