operator: serving install via olm fails
Describe the bug serving install via olm fails with the following error:
Install failed with message: clusterrolebindings.rbac.authorization.k8s.io "knative-serving-controller-admin" is forbidden: user "system:serviceaccount:operators:knative-operator" (groups=["system:serviceaccounts" "system:serviceaccounts:operators" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:[""], Resources:["configmaps"], Verbs:["update" "patch"]}
{APIGroups:[""], Resources:["endpoints"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:[""], Resources:["endpoints/restricted"], Verbs:["create"]}
{APIGroups:[""], Resources:["events"], Verbs:["get" "list" "delete" "watch"]}
{APIGroups:[""], Resources:["namespaces"], Verbs:["list" "create" "delete" "patch"]}
{APIGroups:[""], Resources:["namespaces/finalizers"], Verbs:["update"]}
{APIGroups:[""], Resources:["pods"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:[""], Resources:["secrets"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:[""], Resources:["serviceaccounts"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:[""], Resources:["services"], Verbs:["update" "patch"]}
{APIGroups:["admissionregistration.k8s.io"], Resources:["mutatingwebhookconfigurations"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:["admissionregistration.k8s.io"], Resources:["validatingwebhookconfigurations"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:["apiextensions.k8s.io"], Resources:["customresourcedefinitions/status"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:["apps"], Resources:["deployments"], Verbs:["patch"]}
{APIGroups:["apps"], Resources:["deployments/finalizers"], Verbs:["get" "list" "create" "update" "delete" "patch" "watch"]}
{APIGroups:["autoscaling"], Resources:["horizontalpodautoscalers"], Verbs:["patch" "watch"]}
{APIGroups:["autoscaling.internal.knative.dev"], Resources:["*"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["autoscaling.internal.knative.dev"], Resources:["*/finalizers"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["autoscaling.internal.knative.dev"], Resources:["*/status"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["networking.internal.knative.dev"], Resources:["*"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["networking.internal.knative.dev"], Resources:["*/finalizers"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["networking.internal.knative.dev"], Resources:["*/status"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["serving.knative.dev"], Resources:["*"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["serving.knative.dev"], Resources:["*/finalizers"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
{APIGroups:["serving.knative.dev"], Resources:["*/status"], Verbs:["get" "list" "create" "update" "delete" "deletecollection" "patch" "watch"]}
Expected behavior serving install via olm succeeds
To Reproduce
minikube start
operator-sdk olm install
kubectl create -f https://operatorhub.io/install/knative-operator.yaml
kubectl apply --filename - <<EOF
apiVersion: v1
kind: Namespace
metadata:
name: knative-serving
---
apiVersion: operator.knative.dev/v1alpha1
kind: KnativeServing
metadata:
name: knative-serving
namespace: knative-serving
spec:
ingress:
kourier:
enabled: true
config:
network:
ingress.class: "kourier.ingress.networking.knative.dev"
EOF
Knative release version v0.25.0
Additional context I attempted with the following versions: olm v0.18.3 kubernetes v1.22.1, v1.21.4 Note that install succeeds if operator is installed directly rather than via olm.
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 1
- Comments: 18 (6 by maintainers)
1.9.0 still occurring