operator install on OCP failed

[gyliu513]

Steps

• Install Turbo form operator hub
• Operator install succeed and pod running
• Create xl, operator report errors:

  {"level":"error","ts":1632621233.0738738,"logger":"controller-runtime.manager.controller.xl-controller","msg":"Reconciler error","name":"xl-release","namespace":"turbonomic","error":"failed to install release: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource: clusterrolebindings.rbac.authorization.k8s.io \"turbo-all-binding\" is forbidden: User \"system:serviceaccount:turbonomic:t8c-operator\" cannot get resource \"clusterrolebindings\" in API group \"rbac.authorization.k8s.io\" at the cluster scope","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.2/pkg/internal/controller/controller.go:253\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.2/pkg/internal/controller/controller.go:214"}
  I0926 01:53:54.194253       1 request.go:668] Waited for 1.04755953s due to client-side throttling, not priority and fairness, request: GET:https://172.30.0.1:443/apis/oidc.security.ibm.com/v1?timeout=32s
  {"level":"error","ts":1632621239.5700936,"logger":"helm.controller","msg":"Release failed","namespace":"turbonomic","name":"xl-release","apiVersion":"charts.helm.k8s.io/v1alpha1","kind":"Xl","release":"xl-release","error":"failed to install release: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource: clusterrolebindings.rbac.authorization.k8s.io \"turbo-all-binding\" is forbidden: User \"system:serviceaccount:turbonomic:t8c-operator\" cannot get resource \"clusterrolebindings\" in API group \"rbac.authorization.k8s.io\" at the cluster scope","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.2/pkg/internal/controller/controller.go:298\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.2/pkg/internal/controller/controller.go:253\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.2/pkg/internal/controller/controller.go:214"}

@esara comments? I have to apply https://github.com/turbonomic/t8c-install/blob/master/operator/deploy/cluster_role.yaml and https://github.com/turbonomic/t8c-install/blob/master/operator/deploy/cluster_role_binding.yaml to make this works.

[esara]

@gyliu513 hi, I am guessing you are trying to install kubeturbo using the t8c-operator. While this is possible with the workaround you mentioned, this is not intended. Please use the kubeturbo-operator to deploy kubeturbo https://catalog.redhat.com/software/operators/detail/5e9872763f398525a0ceafb2 which automatically deploys the necessarily roles for kubeturbo - while the t8c-platform runs with minimum permissions that are only needed to run the platform (does not require a clusterrole).

[gyliu513]

@esara thanks for the promptly response on your weekend (it is China's adjusted workday today), it works for me after disable the kubeturbo.

But still have a question, if kubeturbo does not work, I think we need to remove the kubeturbo option from the CRD and do not let customer enable it when installing turbo server, comments?

[esara]

@gyliu513 i'll explain offline the history of why the option is there - there are customers using it today with exactly the workaround you have mentioned.