Description of problem: Compliance Operator fails to deploy (pods in pending status for ever) if the user has defaultNodeSelector set in scheduler - cluster. Version-Release number of selected component (if applicable): 0.1.29 How reproducible: Always Steps to Reproduce: 1. oc edit scheduler cluster 2. set `defaultNodeSelector` to worker as below defaultNodeSelector: node-role.kubernetes.io/worker= 3. Use OLM to install the Compliance Operator Actual results: The Compliance Operator pod gets created but is in `Pending` state of ever. Inspecting the Pod shows that its nodeSelector now has 2 values nodeSelector: node-role.kubernetes.io/master: "" node-role.kubernetes.io/worker: "" Thus making none of the nodes match the selector Expected results: The operator should be in `Running` state Additional info: There exists a workaround for this which is to create apply the following annotation to openshift-compliance (default project that OLM chooses) project openshift.io/node-selector: “”
Note that this is an issue when installing the operator through the UI. When installing the operator through the CLI, one needs to create the namespace manually, and thus is able to set the needed annotations. We'll investigate if we can indicate to the UI what annotations we need. Either way, we need to document this scenario. Thanks for reporting this!
The docs update is in https://github.com/openshift/openshift-docs/pull/31746 and QE verified in the PR
This content is now published: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/security_and_compliance/compliance-operator#installing-compliance-operator-cli_compliance-operator-installation https://docs.openshift.com/container-platform/4.7/security/compliance_operator/compliance-operator-installation.html#installing-compliance-operator-cli_compliance-operator-installation