search

open-cluster-management-io / community

open-cluster-management governance material.
https://open-cluster-management.io
Apache License 2.0
62 stars 23 forks source link

cluster-manager-xxx-webhook-sa cannot list resources for missing permission #40

Open captainroy-hy opened 3 years ago

captainroy-hy commented 3 years ago

In a hub cluster, cluster-manager-work-webhook outputs below error log

reflector.go:138]] k8s.io/client-go@v0.21.0-rc.0/tools/cache/reflector.go:167: Failed to watch *v1beta1.PriorityLevelConfiguration: failed to list *v1beta1.PriorityLevelConfiguration: prioritylevelconfigurations.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:open-cluster-management-hub:cluster-manager-work-webhook-sa" cannot list resource "prioritylevelconfigurations" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope

and cluster-manager-registration-webhook outputs similar error

reflector.go:138] k8s.io/client-go@v0.21.0-rc.0/tools/cache/reflector.go:167: Failed to watch *v1beta1.FlowSchema: failed to list *v1beta1.FlowSchema: flowschemas.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:open-cluster-management-hub:cluster-manager-registration-webhook-sa" cannot list resource "flowschemas" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope                                             
reflector.go:138] k8s.io/client-go@v0.21.0-rc.0/tools/cache/reflector.go:167: Failed to watch *v1beta1.PriorityLevelConfiguration: failed to list *v1beta1.PriorityLevelConfiguration: prioritylevelconfigurations.flowcontrol.apiserver.k8s.io is forbidden: User "system:serviceaccount:open-cluster-management-hub:cluster-manager-registration-webhook-sa" cannot list resource "prioritylevelconfigurations" in API group "flowcontrol.apiserver.k8s.io" at the cluster scope

image: quay.io/open-cluster-management/registration:latest (SHA256: 9a9db2eb9c8a) clustermanager csv 0.4.0

qiujian16 commented 3 years ago

it is because generic apiserver by default enable flow control in 1.21... It will show such error but will not affect the function of webhooks.

We could add permission of flow control or try to disable it in webhook.

/assign @zhiweiyin318 /assign @qiujian16

qiujian16 commented 3 years ago

/kind bug