reopen this bug, found RBAC issue see logs from config daemon: I0228 07:03:50.556351 33907 daemon.go:407] cordoned node "dell-per740" I0228 07:03:50.624263 33907 daemon.go:403] daemonsets.apps "multus" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-multus": multus-782xb; daemonsets.apps "ovnkube-node" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-ovn-kubernetes": ovnkube-node-5jv7j; daemonsets.apps "tuned" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-cluster-node-tuning-operator": tuned-rz94j; daemonsets.apps "dns-default" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-dns": dns-default-plc8k; daemonsets.apps "machine-config-daemon" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-machine-config-operator": machine-config-daemon-9pd98; daemonsets.apps "node-exporter" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-monitoring": node-exporter-rbd4j I0228 07:03:50.624334 33907 daemon.go:407] unable to drain node "dell-per740" I0228 07:03:50.624355 33907 daemon.go:407] there are pending nodes to be drained: dell-per740 I0228 07:03:50.624368 33907 daemon.go:438] drainNode(): Draining failed with: daemonsets.apps "multus" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-multus": multus-782xb; daemonsets.apps "ovnkube-node" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-ovn-kubernetes": ovnkube-node-5jv7j; daemonsets.apps "tuned" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-cluster-node-tuning-operator": tuned-rz94j; daemonsets.apps "dns-default" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-dns": dns-default-plc8k; daemonsets.apps "machine-config-daemon" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-machine-config-operator": machine-config-daemon-9pd98; daemonsets.apps "node-exporter" is forbidden: User "system:serviceaccount:openshift-sriov-network-operator:sriov-network-config-daemon" cannot get resource "daemonsets" in API group "apps" in the namespace "openshift-monitoring": node-exporter-rbd4j, retrying
Verified this bug on 4.3.5-202002280917
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0676