Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1838122

Summary: Add admission webhooks to must-gather for kas-o
Product: OpenShift Container Platform Reporter: Michal Fojtik <mfojtik>
Component: kube-apiserverAssignee: David Eads <deads>
Status: CLOSED ERRATA QA Contact: Ke Wang <kewang>
Severity: high Docs Contact:
Priority: high    
Version: 4.5CC: aos-bugs, mfojtik, xxia
Target Milestone: ---   
Target Release: 4.5.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-13 17:40:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Michal Fojtik 2020-05-20 13:45:42 UTC 
Description of problem:

The must-gather should include the admission configuration for the KAS, that will help us debugging hooks which are misconfigured.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 3 Ke Wang 2020-05-25 07:18:08 UTC 
A refresh OCP cluster with build 4.5.0-0.nightly-2020-05-24-223848 without any mutatingwebhookconfigurations, so we need to add one, see below,

$ cat mutating-admission.yaml 
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: demo-webhook
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: <$BUNDERkey>
    service:
      name: webhook-server
      namespace: webhook-demo
      path: /mutate
  failurePolicy: Ignore
  matchPolicy: Exact
  name: webhook-server.webhook-demo.svc
  namespaceSelector: {}
  objectSelector: {}
  rules:
  - apiGroups:
    - k8s.cni.cncf.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - network-attachment-definitions
    scope: '*'
  sideEffects: NoneOnDryRun
  timeoutSeconds: 30
  
$ oc create -f mutating-admission.yaml

$ oc get mutatingwebhookconfigurations.admissionregistration.k8s.io
NAME           WEBHOOKS   AGE
demo-webhook   1          70s

$ oc adm must-gather

$ ls admissionregistration.k8s.io/*
admissionregistration.k8s.io/mutatingwebhookconfigurations:
demo-webhook.yaml

admissionregistration.k8s.io/validatingwebhookconfigurations:
autoscaling.openshift.io.yaml  multus.openshift.io.yaml

The expected admissionregistration has been gathered, move the bug to verified.
Comment 4 errata-xmlrpc 2020-07-13 17:40:29 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409