Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

devworkspace-che-role is forbidden when deploying Che with DevWorkspace operator #19283

Closed
l0rd opened this issue Mar 15, 2021 · 0 comments
Closed
Labels
area/che-operator Issues and PRs related to Eclipse Che Kubernetes Operator area/chectl Issues related to chectl, the CLI of Che kind/bug Outline of a bug - must adhere to the bug report template. severity/blocker Causes system to crash and be non-recoverable or prevents Che developers from working on Che code.
Milestone

Comments

@l0rd
Copy link
Contributor

l0rd commented Mar 15, 2021

Describe the bug

Installation of nightly Che with devworkspace enabled fails.

This is the error message I see in the Che operator logs:

time="2021-03-15T10:01:15Z" level=info msg="Creating a new object: ClusterRole, name devworkspace-che-role"
time="2021-03-15T10:01:16Z" level=error msg="clusterroles.rbac.authorization.k8s.io \"devworkspace-che-role\" is forbidden: user \"system:serviceaccount:workspaces-server:che-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:workspaces-server\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"configmap\"], Verbs:[\"create\" \"delete\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]}\n{APIGroups:[\"apps\"], Resources:[\"deployments/finalizers\"], ResourceNames:[\"devworkspace-che-operator\"], Verbs:[\"update\"]}\n{APIGroups:[\"che.eclipse.org\"], Resources:[\"*\"], Verbs:[\"*\"]}\n{APIGroups:[\"che.eclipse.org\"], Resources:[\"chemanagers\"], Verbs:[\"*\"]}\n{APIGroups:[\"che.eclipse.org\"], Resources:[\"chemanagers/finalizers\"], Verbs:[\"update\"]}\n{APIGroups:[\"che.eclipse.org\"], Resources:[\"chemanagers/status\"], Verbs:[\"get\" \"patch\" \"update\"]}"
time="2021-03-15T10:01:17Z" level=info msg="Removing 'cheWorkspaces.clusterpermissions.finalizers.che.eclipse.org'

Che version

nightly

Steps to reproduce

Deploy Che a fresh OCP 4.7.1 cluster with chectl and a CR patch to enable devworkspace.

Runtime

OpenShift 4.7.1

Installation method

$ chectl version
chectl/0.0.20210314-next.c60bdec darwin-x64 node-v12.21.0
$ cat ./patch.yaml
spec:
  devWorkspace:
    enable: true
$ chectl server:deploy --che-operator-cr-patch-yaml=patch.yaml -p openshift --no-olm-suggested-namespace -n workspaces-server

Environment

OpenShift Dev Cluster

@l0rd l0rd added the kind/bug Outline of a bug - must adhere to the bug report template. label Mar 15, 2021
@che-bot che-bot added the status/need-triage An issue that needs to be prioritized by the curator responsible for the triage. See https://github. label Mar 15, 2021
@l0rd l0rd added area/che-operator Issues and PRs related to Eclipse Che Kubernetes Operator area/chectl Issues related to chectl, the CLI of Che severity/blocker Causes system to crash and be non-recoverable or prevents Che developers from working on Che code. and removed status/need-triage An issue that needs to be prioritized by the curator responsible for the triage. See https://github. labels Mar 15, 2021
@tolusha tolusha closed this as completed Mar 16, 2021
@tolusha tolusha added this to the 7.28 milestone Mar 16, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/che-operator Issues and PRs related to Eclipse Che Kubernetes Operator area/chectl Issues related to chectl, the CLI of Che kind/bug Outline of a bug - must adhere to the bug report template. severity/blocker Causes system to crash and be non-recoverable or prevents Che developers from working on Che code.
Projects
None yet
Development

No branches or pull requests

3 participants