Bug 2057403 - CMO logs show forbidden: User "system:serviceaccount:openshift-monitoring:cluster-monitoring-operator" cannot get resource "replicasets" in API group "apps" in the namespace "openshift-monitoring"
Summary: CMO logs show forbidden: User "system:serviceaccount:openshift-monitoring:clu...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Monitoring
Version: 4.11
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
: 4.11.0
Assignee: Simon Pasquier
QA Contact: hongyan li
URL:
Whiteboard:
Depends On:
Blocks: 2058148
TreeView+ depends on / blocked
 
Reported: 2022-02-23 10:40 UTC by Jayapriya Pai
Modified: 2022-08-10 10:51 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-08-10 10:50:55 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-monitoring-operator pull 1564 0 None Merged Bug 2057403: jsonnet: Give CMO explicit get permissions for ReplicaSets 2022-02-25 06:20:58 UTC
Red Hat Product Errata RHSA-2022:5069 0 None None None 2022-08-10 10:51:12 UTC

Description Jayapriya Pai 2022-02-23 10:40:11 UTC
Description of problem:
CMO log shows following warning message which is not expected

```
oc logs cluster-monitoring-operator-667d4459f-cdnvd cluster-monitoring-operator
W0223 06:10:06.682008       1 client_config.go:617] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
W0223 06:10:07.738053       1 operator.go:313] unable to get owner reference (falling back to namespace): replicasets.apps "cluster-monitoring-operator-667d4459f" is forbidden: User "system:serviceaccount:openshift-monitoring:cluster-monitoring-operator" cannot get resource "replicasets" in API group "apps" in the namespace "openshift-monitoring"
```

Version-Release number of selected component (if applicable):

4.11

How reproducible:

Check logs for CMO from pod

Steps to Reproduce:
1. Check logs for CMO from pod

oc logs <cluster-monitoring-operator pod name> cluster-monitoring-operator -n openshift-monitoring

2.
3.

Actual results:

```
W0223 06:10:07.738053       1 operator.go:313] unable to get owner reference (falling back to namespace): replicasets.apps "cluster-monitoring-operator-667d4459f" is forbidden: User "system:serviceaccount:openshift-monitoring:cluster-monitoring-operator" cannot get resource "replicasets" in API group "apps" in the namespace "openshift-monitoring"
```

Expected results:

Warning should not be there

Additional info:

Comment 1 Brad Ison 2022-02-23 13:45:43 UTC
Posted a PR with a quick fix. Not seeing these warnings logged now:

$ kubectl -n openshift-monitoring logs --tail=-1 -l 'app=cluster-monitoring-operator' -c cluster-monitoring-operator  | grep -c 'unable to get owner'
0

Comment 3 Junqi Zhao 2022-02-24 09:21:55 UTC
reproduced with 4.11.0-0.nightly-2022-02-23-185405
# kubectl -n openshift-monitoring logs --tail=-1 -l 'app=cluster-monitoring-operator' -c cluster-monitoring-operator  | grep -c 'unable to get owner'
1
waiting for the PR merged to 4.11

Comment 6 hongyan li 2022-02-25 03:10:50 UTC
test with payload 4.11.0-0.nightly-2022-02-24-054925, no such error in the log

Comment 11 errata-xmlrpc 2022-08-10 10:50:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 4.11.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:5069


Note You need to log in before you can comment on or make changes to this bug.