Kata deployment stalls with invalid extensions error

[benemon]

Description

Steps to reproduce the issue:

1. oc label node runtime=kata
2. update the CRD as described by the docs to target a specific node

kind: KataConfig
metadata:
  name: demolab-kataconfig
spec:
  kataConfigPoolSelector:
    matchLabels:
       runtime: kata

3. run the deployment steps as described by the docs

Describe the results you received:
Kata operator is deployed successfully.

Rollout of kata runtime stalls after creation of CR with

Status:
  Installation Status:
    Is In Progress:  True
    Completed:
    Failed:
      Failed Nodes Reason:  Node skylake-fn6tt-worker-5mzzg is reporting: "invalid extensions found: [sandboxed-containers]"

This condition is never reconciled.

Describe the results you expected:
Succesful deployment of kata runtime

Additional information you deem important (e.g. issue happens only occasionally):

Output of oc describe kataconfig <your-kataconfig>:

Name:         demolab-kataconfig
Namespace:    
Labels:       <none>
Annotations:  <none>
API Version:  kataconfiguration.openshift.io/v1
Kind:         KataConfig
Metadata:
  Creation Timestamp:  2021-06-02T11:20:01Z
  Finalizers:
    finalizer.kataconfiguration.openshift.io
  Generation:  2
  Managed Fields:
    API Version:  kataconfiguration.openshift.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:spec:
        .:
        f:kataConfigPoolSelector:
          .:
          f:matchLabels:
            .:
            f:runtime:
    Manager:      kubectl-create
    Operation:    Update
    Time:         2021-06-02T11:20:01Z
    API Version:  kataconfiguration.openshift.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:"finalizer.kataconfiguration.openshift.io":
      f:spec:
        f:config:
          .:
          f:sourceImage:
      f:status:
        .:
        f:installationStatus:
          .:
          f:IsInProgress:
          f:completed:
          f:failed:
            .:
            f:failedNodesReason:
          f:inprogress:
        f:kataImage:
        f:prevMcpGeneration:
        f:runtimeClass:
        f:totalNodesCount:
        f:unInstallationStatus:
          .:
          f:completed:
          f:failed:
          f:inProgress:
            .:
            f:status:
        f:upgradeStatus:
    Manager:         manager
    Operation:       Update
    Time:            2021-06-02T11:22:37Z
  Resource Version:  52292
  Self Link:         /apis/kataconfiguration.openshift.io/v1/kataconfigs/demolab-kataconfig
  UID:               8fe6d0c6-d44d-4c99-8afb-238ec8ad2444
Spec:
  Config:
    Source Image:  
  Kata Config Pool Selector:
    Match Labels:
      Runtime:  kata
Status:
  Installation Status:
    Is In Progress:  True
    Completed:
    Failed:
      Failed Nodes Reason:  Node skylake-fn6tt-worker-5mzzg is reporting: "invalid extensions found: [sandboxed-containers]"
    Inprogress:
  Kata Image:           
  Prev Mcp Generation:  2
  Runtime Class:        
  Total Nodes Count:    1
  Un Installation Status:
    Completed:
    Failed:
    In Progress:
      Status:  
  Upgrade Status:
Events:  <none>

Additional environment details (platform, options, etc.):
OCP 4.7.12, IPI install on vSphere.

[bpradipt]

@benemon can you please describe the steps you are using to install the operator ?
The error message points me to a mismatch of operator version and the OCP cluster. The sandboxed-containers extension is only available with OCP 4.8

[jensfr]

Hi @benemon,

thanks for opening the issue! The sandboxed-containers extension is only available with OCP 4.8+. The instructions you're following are for an OCP 4.8 cluster.

You are on OCP 4.7.12 so I recommend you follow this README instead: https://github.com/openshift/sandboxed-containers-operator/blob/release-4.7/README.md

Sorry for the confusion! Let us know if you run into any trouble!

[benemon]

Hi @jensfr - those are the instructions I was following. Is there any issue with the fact that the 4.7 docs refer to the master branch of the repository?

Edit: I should add that I'm following the 'git repo chekcout' path, with 'Selectively install the Kata runtime on specific workers' path

[jensfr]

@benemon oh yes, you found a bug. We need to change the README on the release-4.7 branch. I'll change it now.

[jensfr]

@benemon Would you mind reviewing #114?

[benemon]

Sure thing - I'm just respinning my OCP cluster and then I'll give it a go.

[benemon]

Reviewed #114 as per request. Updtaed instructions resulted in a successful Kata runtime deployment onto specific targetted node.