-
Notifications
You must be signed in to change notification settings - Fork 109
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
"main" errors out with controller-runtime error #806
Comments
So tekton calls this api machinery api: https://github.com/tektoncd/pipeline/blob/b7fa888082bd20e08edc3b89b6b4d52ed4f00651/pkg/pod/pod.go#L295 Which leads to the setting of BlockOwnerDeletion to true at https://github.com/tektoncd/pipeline/blob/c8dc797cf5a6f11f90cb742d014470a444fcdc60/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go#L55 But according to So, circling back to @imjasonh 's reduce RBAC permission PR he did remove permissions on but I don't think that setting that permission gets you Then, considering the doc around
I looked for any possible recent changes for the `foregroundDeletion" finalizer, but I see no refs to that string or the metav1 constant defined for that. For now, going to include readding the deployment finalizer perm into the list of permutations to try, and go from there. |
@adambkaplan confirmed that the same issue on the current main branch occurs at openshift 4.7 (which means a different version of k8s more aligned with the current shipwright k8s dependency) |
Root error I'm seeing is
|
Note - after granting the controller permission to delete |
the 4.7 vs. 4.8 variants are interesting that said, for both permutations, revisting the rbac reduction PR, add/update/delete perms were removed on some of the object types in question for me as well I'm systematically am adding removed perms for those types to at least get to a level playing field then I'll see about adding specific finalizer perms |
It appears on OpenShift that the OwnerRefererencesPermissionEnforcement admission controller is enabled by default. It is unclear if this admission controller is enabled or disabled by default on kind. |
To reiterate some detail I posted elsewhere here, when I replace deploying shipwright from main branch with
on the same OpenShift and Tekton versions things work. |
OK I had to add finalizer permissions to get it to work again. Now seeing if some of the perms that I readded that were removed via #768 have any bearing |
turns out, we only need permissions on on 4.8 at least @adambkaplan and installing openshift pipelines to get tekton, I did NOT have to add delete perms on buildrun objs as you noted above Now, circling back to @imjasonh 's rbac reduction PR, I believe https://github.com/shipwright-io/build/pull/768/files#diff-4633b495133d1f73df291ee1bff05516c88e81f569e876994cf2239a4c5c0ba7L72 and the use of So I think we can at least say with certainty that that PR caused this issue, as we originally guessed/assumed. Lastly, to potentially build upon @adambkaplan 's notes in #806 (comment), looking at the error message in what I got:
the reference to the taskrun initially threw me off and had me thinking about taskerror":"taskruns.tekton.dev "buildpack-nodejs-build-87cwh-49krk" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , "run permisssions, but now that I now what precise permission is needed, I guess the text could be construed as if the Fine tuning the new permision to only include the required verbs, and then will have a PR up shortly. |
Initial discussion #768 (comment)
The text was updated successfully, but these errors were encountered: