# oc adm release extract --to manifests registry.ci.openshift.org/ocp/release:4.7.0-0.nightly-2021-06-12-151209 Extracted release payload from digest sha256:a8873b0c5c017864effc7323bebdb2d3c7244973a0892362b04e3d8510240e0c created at 2021-06-12T15:17:00Z # grep -r 'apiVersion: rbac' manifests | grep v1beta1 manifests/0000_50_cluster-autoscaler-operator_03_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1 manifests/0000_50_cluster-autoscaler-operator_03_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1 manifests/0000_70_cluster-network-operator_02_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1 manifests/0000_80_machine-config-operator_03_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1 manifests/0000_50_operator-marketplace_06_role_binding.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1 manifests/0000_50_operator-marketplace_06_role_binding.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1 In 4.7, not only autoscaler but also network, machine-config and marketplace have rbacv1beta1 defined in manifests. # oc get clusterrolebinding default-account-cluster-network-operator -n openshift-network-operator -oyaml | grep rbac apiVersion: rbac.authorization.k8s.io/v1 - apiVersion: rbac.authorization.k8s.io/v1beta1 selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/default-account-cluster-network-operator apiGroup: rbac.authorization.k8s.io # oc get clusterrolebinding default-account-openshift-machine-config-operator -n openshift-machine-config-operator -oyaml| grep rbac apiVersion: rbac.authorization.k8s.io/v1 - apiVersion: rbac.authorization.k8s.io/v1beta1 selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/default-account-openshift-machine-config-operator apiGroup: rbac.authorization.k8s.io # oc get clusterrolebinding marketplace-operator -n openshift-marketplace -oyaml | grep rbac apiVersion: rbac.authorization.k8s.io/v1 - apiVersion: rbac.authorization.k8s.io/v1beta1 selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/marketplace-operator apiGroup: rbac.authorization.k8s.io Looks like those in-cluster clusterrolebindings use the rbacv1. Vadim, could you please help confirm if only autoscaler needs to be fixed?
You are correct, more PRs are required to make it work properly: * cluster-autoscaler - https://github.com/openshift/cluster-autoscaler-operator/pull/206 * network-operator - https://github.com/openshift/cluster-network-operator/pull/1134 * machine-config-operator - https://github.com/openshift/machine-config-operator/pull/2620 * marketplace-operator - https://github.com/operator-framework/operator-marketplace/pull/409
Vadim, is PR in CVO required as well? We have CVO PR[1] in 4.8. [1] CVO - https://github.com/openshift/cluster-version-operator/pull/565
Vadim, could you please take a look at comment#3? Thanks
(In reply to Yang Yang from comment #4) > Vadim, could you please take a look at comment#3? Thanks Correct, after PRs from comment#2 are merged we can proceed with cherry-picking https://github.com/openshift/cluster-version-operator/pull/565 on release-4.8
Vadim, > Correct, after PRs from comment#2 are merged we can proceed with cherry-picking https://github.com/openshift/cluster-version-operator/pull/565 on release-4.8 The PRs from comment#2 get merged. Would you like to cherry-pick the CVO PR to proceed at this moment? Thanks!
Done, created https://github.com/openshift/cluster-version-operator/pull/652
Verifying with 4.7.0-0.nightly-2021-09-22-201816 # oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.7.0-0.nightly-2021-09-22-201816 True False 137m Cluster version is 4.7.0-0.nightly-2021-09-22-201816 # oc adm release extract --to 4.7 Extracted release payload created at 2021-09-22T20:21:28Z # grep -r 'apiVersion: rbac' 4.7 | grep v1beta1 null # oc get po -n openshift-cluster-version NAME READY STATUS RESTARTS AGE cluster-version-operator-56f859b98d-shtps 1/1 Running 0 166m # oc logs pod/cluster-version-operator-56f859b98d-shtps -n openshift-cluster-version > cvo.log # grep 'rbac.authorization.k8s.io/v1beta1' cvo.log I0923 03:16:51.519313 1 request.go:591] Throttling request took 1.472133091s, request: GET:https://api-int.yangyang0923.qe.gcp.devcluster.openshift.com:6443/apis/rbac.authorization.k8s.io/v1beta1?timeout=32s No resources are using rbacv1beta1. Moving it to verified state.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.7.33 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:3686