Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Hard-coded ClusterRoleName in OwnerRef breaks when Kyverno Helm Chart name is unique #2713

Closed
diranged opened this issue Nov 10, 2021 · 2 comments · Fixed by #2718
Closed
Assignees
Labels
bug Something isn't working

Comments

@diranged
Copy link

Software version numbers

  • Kubernetes version: 1.21
  • Kubernetes platform (if applicable; ex., EKS, GKE, OpenShift): EKS
  • Kyverno version: v1.5.0-rc1-118-g17e671bf

Describe the bug
Kyverno is unable to create resources due to an invalid OwnerRef:

E1110 20:18:06.802944       1 registration.go:291] Register "msg"="failed to create resource mutating webhook configuration" "error"="MutatingWebhookConfiguration.admissionregistration.k8s.io \"kyverno-resource-mutating-webhook-cfg\" is invalid: [metadata.ownerReferences.apiVersion: Invalid value: \"\": version must not be empty, metadata.ownerReferences.kind: Invalid value: \"\": kind must not be empty, metadata.ownerReferences.name: Invalid value: \"\": name must not be empty, metadata.ownerReferences.uid: Invalid value: \"\": uid must not be empty]" "kind"="MutatingWebhookConfiguration" "name"="kyverno-resource-mutating-webhook-cfg"
I1110 20:18:06.864740       1 registration.go:641] Register "msg"="Endpoint ready"  "name"="kyverno-cpusdr1mm3-svc" "ns"="kyverno-cpusdr1mm3"
E1110 20:18:07.399447       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:07.703296       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:08.073875       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:08.466831       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:08.666886       1 registration.go:317] Register "msg"="failed to create resource" "error"="ValidatingWebhookConfiguration.admissionregistration.k8s.io \"kyverno-resource-validating-webhook-cfg\" is invalid: [metadata.ownerReferences.apiVersion: Invalid value: \"\": version must not be empty, metadata.ownerReferences.kind: Invalid value: \"\": kind must not be empty, metadata.ownerReferences.name: Invalid value: \"\": name must not be empty, metadata.ownerReferences.uid: Invalid value: \"\": uid must not be empty]" "kind"="ValidatingWebhookConfiguration" "name"="kyverno-resource-validating-webhook-cfg" 
E1110 20:18:08.870873       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:09.050093       1 registration.go:291] Register "msg"="failed to create resource mutating webhook configuration" "error"="MutatingWebhookConfiguration.admissionregistration.k8s.io \"kyverno-resource-mutating-webhook-cfg\" is invalid: [metadata.ownerReferences.apiVersion: Invalid value: \"\": version must not be empty, metadata.ownerReferences.kind: Invalid value: \"\": kind must not be empty, metadata.ownerReferences.name: Invalid value: \"\": name must not be empty, metadata.ownerReferences.uid: Invalid value: \"\": uid must not be empty]" "kind"="MutatingWebhookConfiguration" "name"="kyverno-resource-mutating-webhook-cfg"
I1110 20:18:09.547246       1 registration.go:641] Register "msg"="Endpoint ready"  "name"="kyverno-cpusdr1mm3-svc" "ns"="kyverno-cpusdr1mm3"
E1110 20:18:09.897391       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:10.306844       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:10.718846       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:11.023996       1 common.go:65] Register "msg"="failed to construct OwnerReference" "error"="clusterroles.rbac.authorization.k8s.io \"kyverno:webhook\" not found"  
E1110 20:18:11.221195       1 registration.go:317] Register "msg"="failed to create resource" "error"="ValidatingWebhookConfiguration.admissionregistration.k8s.io \"kyverno-resource-validating-webhook-cfg\" is invalid: [metadata.ownerReferences.apiVersion: Invalid value: \"\": version must not be empty, metadata.ownerReferences.kind: Invalid value: \"\": kind must not be empty, metadata.ownerReferences.name: Invalid value: \"\": name must not be empty, metadata.ownerReferences.uid: Invalid value: \"\": uid must not be empty]" "kind"="ValidatingWebhookConfiguration" "name"="kyverno-resource-validating-webhook-cfg" 

The issue is that #2659 hard-codes the expected name of the ClusterRole, while at https://github.com/kyverno/kyverno/blob/main/charts/kyverno/templates/clusterrole.yaml#L20-L24 it is dynamic.

@diranged diranged added the bug Something isn't working label Nov 10, 2021
@diranged diranged changed the title [BUG] [BUG] Hard-coded ClusterRoleName in OwnerRef breaks when Kyverno Helm Chart name is unique Nov 10, 2021
@diranged
Copy link
Author

cc @vyankyGH

@vyankyGH
Copy link
Contributor

@diranged We are planning to add extra Label to ClusterRole and will get ClusterRole from that instead of hardcoding it fix this issue. Will this solution works for you?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants