RBAC error running on OCP 4.x

[quay]

RBAC error running on OCP 4.x

[sabre1041]

This is a confirmed bug. Addressed by #79. We will be looking to push our a new version soon and then published to Operator Hub

[BillDett]

Yes- works fine now. Thanks for the quick fix Andrew!

[daufinsyd]

I have the same error

{"level":"error","ts":1569936976.630348,"logger":"util","msg":"unable to create object","object":{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","namespace":"quay-enterprise","name":"example-quayecosystem"},"error":"roles.rbac.authorization.k8s.io \"example-quayecosystem\" is forbidden: user \"system:serviceaccount:quay-enterprise:quay-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:quay-enterprise\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"secrets\"], Verbs:[\"put\"]}","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/home/travis/gopath/pkg/mod/github.com/go-logr/[email protected]/zapr.go:128\ngithub.com/redhat-cop/operator-utils/pkg/util.(*ReconcilerBase).CreateOrUpdateResource\n\t/home/travis/gopath/pkg/mod/github.com/redhat-cop/[email protected]/pkg/util/reconciler.go:153\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning.(*ReconcileQuayEcosystemConfiguration).createRBAC\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning/provision.go:585\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning.(*ReconcileQuayEcosystemConfiguration).CoreQuayResourceDeployment\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning/provision.go:59\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem.(*ReconcileQuayEcosystem).Reconcile\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/quayecosystem_controller.go:136\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:215\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func1\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:158\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:134\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:88"}
{"level":"error","ts":1569936976.6304488,"logger":"controller_quayecosystem","msg":"Failed to create RBAC","error":"roles.rbac.authorization.k8s.io \"example-quayecosystem\" is forbidden: user \"system:serviceaccount:quay-enterprise:quay-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:quay-enterprise\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"secrets\"], Verbs:[\"put\"]}","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/home/travis/gopath/pkg/mod/github.com/go-logr/[email protected]/zapr.go:128\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning.(*ReconcileQuayEcosystemConfiguration).CoreQuayResourceDeployment\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning/provision.go:60\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem.(*ReconcileQuayEcosystem).Reconcile\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/quayecosystem_controller.go:136\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:215\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func1\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:158\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:134\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:88"}
{"level":"info","ts":1569937266.6427338,"logger":"controller_quayecosystem","msg":"Reconciling QuayEcosystem","Request.Namespace":"quay-enterprise","Request.Name":"example-quayecosystem"}
{"level":"error","ts":1569937266.6818974,"logger":"util","msg":"unable to create object","object":{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","namespace":"quay-enterprise","name":"example-quayecosystem"},"error":"roles.rbac.authorization.k8s.io \"example-quayecosystem\" is forbidden: user \"system:serviceaccount:quay-enterprise:quay-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:quay-enterprise\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"secrets\"], Verbs:[\"put\"]}","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/home/travis/gopath/pkg/mod/github.com/go-logr/[email protected]/zapr.go:128\ngithub.com/redhat-cop/operator-utils/pkg/util.(*ReconcilerBase).CreateOrUpdateResource\n\t/home/travis/gopath/pkg/mod/github.com/redhat-cop/[email protected]/pkg/util/reconciler.go:153\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning.(*ReconcileQuayEcosystemConfiguration).createRBAC\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning/provision.go:585\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning.(*ReconcileQuayEcosystemConfiguration).CoreQuayResourceDeployment\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning/provision.go:59\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem.(*ReconcileQuayEcosystem).Reconcile\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/quayecosystem_controller.go:136\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:215\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func1\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:158\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:134\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:88"}
{"level":"error","ts":1569937266.681981,"logger":"controller_quayecosystem","msg":"Failed to create RBAC","error":"roles.rbac.authorization.k8s.io \"example-quayecosystem\" is forbidden: user \"system:serviceaccount:quay-enterprise:quay-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:quay-enterprise\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"secrets\"], Verbs:[\"put\"]}","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\t/home/travis/gopath/pkg/mod/github.com/go-logr/[email protected]/zapr.go:128\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning.(*ReconcileQuayEcosystemConfiguration).CoreQuayResourceDeployment\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/provisioning/provision.go:60\ngithub.com/redhat-cop/quay-operator/pkg/controller/quayecosystem.(*ReconcileQuayEcosystem).Reconcile\n\t/home/travis/gopath/src/github.com/redhat-cop/quay-operator/pkg/controller/quayecosystem/quayecosystem_controller.go:136\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:215\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func1\n\t/home/travis/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:158\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:134\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/home/travis/gopath/pkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:88"}

Deploying using the operator doesn't failed on this

[lisa]

Encountered this with a 4.2 nightly build as well.

[sabre1041]

@BillDett @lisa @daufinsyd version v0.0.7 released and published to operratorhub.io. I was able to use it in my OCP cluster to stand up Quay successfully

Can you retest?