Bug 2005581: install/0000_00_cluster-version-operator_03_deployment: Explicit kube-api-access #660
Conversation
openshift-ci
bot
added
bugzilla/severity-urgent
|
@wking: This pull request references Bugzilla bug 2005581, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci
bot
requested review from
LalatenduMohanty,
jianlinliu and
jottofar
openshift-ci
bot
added
the
approved
wking
force-pushed
the
explicit-kube-api-access-volume
branch
from
5bbd270 to
b411810
Compare
…-api-access This content is injected by an admission webhook [1,2]. When we started removing not-in-manifest volumes in 83faa6e (lib/resourcemerge/core: Remove unrecognized volumes and mounts, 2021-09-14, openshift#654), the cluster-version operator started removing the webhook-injected volume, leading to the cluster-version operator crash-looping on updates from 4.8 to 4.9 with messages like [3]: F0920 13:23:23.565439 1 start.go:24] error: error creating clients: invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable With this commit, we follow the precedent of the Kubernetes API server's own manifest [4,5]. [1]: https://github.com/kubernetes/kubernetes/blob/2f68346fbb6246961ce0a3176418630950aea500/plugin/pkg/admission/serviceaccount/admission.go#L53-L54 [2]: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#bound-service-account-token-volume [3]: https://bugzilla.redhat.com/show_bug.cgi?id=2005581 [4]: openshift/cluster-kube-apiserver-operator#1142 [5]: https://bugzilla.redhat.com/show_bug.cgi?id=1946479
wking
force-pushed
the
explicit-kube-api-access-volume
branch
from
b411810 to
97289cc
Compare
|
@wking in the openshift/cluster-kube-apiserver-operator#1142 , I see a comment about |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: LalatenduMohanty, wking The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test e2e-agnostic-operator |
|
@wking: All pull requests linked via external trackers have merged: Bugzilla bug 2005581 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
fix openshift#660 and openshift#607 Signed-off-by: lan.tian <[email protected]>
4 participants
This content is injected by an admission webhook. When we started removing not-in-manifest volumes in 83faa6e (#654), the cluster-version operator started removing the webhook-injected volume, leading to the cluster-version operator crash-looping on updates from 4.8 to 4.9 with messages like:
With this commit, we follow the precedent of the Kubernetes API server's own manifest: openshift/cluster-kube-apiserver-operator#1142.