Bug 1951636 - assisted service operator use default serviceaccount in operator bundle
Summary: assisted service operator use default serviceaccount in operator bundle
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: assisted-installer
Version: 4.8
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.8.0
Assignee: David Zager
QA Contact: Chad Crum
URL:
Whiteboard: AI-Team-Platform
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-04-20 15:42 UTC by Hao Liu
Modified: 2021-07-27 23:02 UTC (History)
7 users (show)

Fixed In Version: OCP-Metal-v1.0.20.1
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-27 23:02:11 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift assisted-service pull 1557 0 None open OCPBUGSM-28017: fix operator manifests 2021-05-04 16:18:07 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 23:02:26 UTC

Description Hao Liu 2021-04-20 15:42:20 UTC
Description of problem:
ACM is trying to integrate with the assisted installer operator by including the assisted installer operator into the ACM bundle 

during the bundle integration process we notice the following error 

```
Error: CSV is defining permissions for the default service account
Error: CSV deployment assisted-service-operator is using the default service account.
   Install deployment: assisted-service-operator
```

Version-Release number of selected component (if applicable):
version 0.0.2 in ocm-2.3 channel

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Chuck Brant 2021-05-04 15:56:22 UTC
Is there a place this work item is being tracked, as I don't see any updates inBX

Comment 3 nshidlin 2021-06-24 16:14:03 UTC
@haoli could you please provide some more information on how to reproduce this issue? thanks

Comment 4 Chad Crum 2021-07-07 13:47:20 UTC
@cchun - Do you have any idea how to reproduce this? I'm not sure how much longer Hao will be out.

Comment 5 David Zager 2021-07-07 14:00:23 UTC
@ccrum All you need to do is take a look at the infrastructure-operator's deployment to see what serviceaccount it's using (should be assisted-service). If you create an agentserviceconfig, the resulting assisted-service deployment should also be using assisted-service for it's serviceaccount.

Comment 7 Chad Crum 2021-07-13 13:50:02 UTC
This has been validated in 2.3.0-DOWNSTREAM-2021-07-12-15-34-40

Service account used by assisted service pod is assisted-service

[root@sealusa12 auth]# oc get pod assisted-service-549cb88686-jwvhf -o yaml | grep -i serviceaccount
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
  serviceAccount: assisted-service
  serviceAccountName: assisted-service
[root@sealusa12 auth]# oc get deployment infrastructure-operator -o yaml | grep -i serviceaccount
              fieldPath: spec.serviceAccountName
      serviceAccount: assisted-service
      serviceAccountName: assisted-service

Comment 10 errata-xmlrpc 2021-07-27 23:02:11 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.