Bug 2106840 - User "system:service account:openshift-nmstate:nmstate-operator" cannot list resource "nodes" in API group "" at the cluster scope
Summary: User "system:service account:openshift-nmstate:nmstate-operator" cannot list ...
Keywords:
Status: CLOSED DUPLICATE of bug 2104938
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.10
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: ---
Assignee: Ben Nemec
QA Contact: Victor Voronkov
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-07-13 16:15 UTC by Alexander Chuzhoy
Modified: 2022-07-13 17:03 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-07-13 17:03:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Alexander Chuzhoy 2022-07-13 16:15:14 UTC
Version:
OCP: 4.10.20
kubernetes-nmstate-operator.4.10.0-202207041436

Noticed that creating an instance with the following didn't start any pods.

```
apiVersion: nmstate.io/v1
kind: NMState
metadata:
  name: nmstate  
  namespace: openshift-nmstate
```



The log of the operator shows:

sh-4.4# oc logs nmstate-operator-97457cc77-jz8vq                                                                                                                       
I0713 15:52:36.824352       1 request.go:665] Waited for 1.038205998s due to client-side throttling, not priority and fairness, request: GET:https://172.30.0.1:443/apis/machineconfiguration.openshift.io/v1?timeo
ut=32s                                                                                                                                                                 
{"level":"info","ts":"2022-07-13T15:52:38.529Z","logger":"setup","msg":"starting manager"}                                                                             
{"level":"info","ts":"2022-07-13T15:52:38.529Z","logger":"controller.nmstate","msg":"Starting EventSource","reconciler group":"nmstate.io","reconciler kind":"NMState","source":"kind source: *v1.NMState"}
{"level":"info","ts":"2022-07-13T15:52:38.529Z","logger":"controller.nmstate","msg":"Starting Controller","reconciler group":"nmstate.io","reconciler kind":"NMState"} 
{"level":"info","ts":"2022-07-13T15:52:38.630Z","logger":"controller.nmstate","msg":"Starting workers","reconciler group":"nmstate.io","reconciler kind":"NMState","worker count":1}
2022/07/13 15:52:38 reconciling (apiextensions.k8s.io/v1, Kind=CustomResourceDefinition) /nodenetworkconfigurationenactments.nmstate.io                                
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (apiextensions.k8s.io/v1, Kind=CustomResourceDefinition) /nodenetworkconfigurationpolicies.nmstate.io                                  
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (apiextensions.k8s.io/v1, Kind=CustomResourceDefinition) /nodenetworkstates.nmstate.io                                                                                            
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (/v1, Kind=Namespace) /openshift-nmstate                                                                                               
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (rbac.authorization.k8s.io/v1, Kind=Role) openshift-nmstate/nmstate-handler                                                            
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (rbac.authorization.k8s.io/v1, Kind=ClusterRole) openshift-nmstate/nmstate-handler                                                     
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (rbac.authorization.k8s.io/v1, Kind=RoleBinding) openshift-nmstate/nmstate-handler                                                     
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (rbac.authorization.k8s.io/v1, Kind=ClusterRoleBinding) openshift-nmstate/nmstate-handler                                              
2022/07/13 15:52:38 update was successful                                                                                                                              
2022/07/13 15:52:38 reconciling (/v1, Kind=ServiceAccount) openshift-nmstate/nmstate-handler                                                                           
2022/07/13 15:52:38 update was successful                                                                                                                              
E0713 15:52:38.737104       1 reflector.go:138] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: Failed to watch *v1.Node: failed to list *v1.Node: nodes is forbidden: User "system:service
account:openshift-nmstate:nmstate-operator" cannot list resource "nodes" in API group "" at the cluster scope                                                          
E0713 15:52:39.618826       1 reflector.go:138] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: Failed to watch *v1.Node: failed to list *v1.Node: nodes is forbidden: User "system:service
account:openshift-nmstate:nmstate-operator" cannot list resource "nodes" in API group "" at the cluster scope                                                          
E0713 15:52:42.629547       1 reflector.go:138] sigs.k8s.io/controller-runtime/pkg/cache/internal/informers_map.go:250: Failed to watch *v1.Node: failed to list *v1.Node: nodes is forbidden: User "system:service
account:openshift-nmstate:nmstate-operator" cannot list resource "nodes" in API group "" at the cluster scope
sh-4.4# 




After applying the following workaround, all the expected pods successfully started:
oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:openshift-nmstate:nmstate-operator

Comment 1 Ben Nemec 2022-07-13 17:03:01 UTC

*** This bug has been marked as a duplicate of bug 2104938 ***


Note You need to log in before you can comment on or make changes to this bug.