Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1357248 - Some serviceaccounts are delayed to create after project created
Summary: Some serviceaccounts are delayed to create after project created
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Auth
Version: 3.2.1
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 3.2.1
Assignee: Jordan Liggitt
QA Contact: weiwei jiang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-17 08:07 UTC by Bardi Harborow
Modified: 2017-02-23 00:54 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1324179
Environment:
Last Closed: 2016-07-27 19:08:59 UTC


Attachments (Terms of Use)

Description Bardi Harborow 2016-07-17 08:07:41 UTC
#1324179 has regressed.

After waiting for quota reconciliation (see #1351705), and then creating a new jenkins quickstart, I get this:

Error creating deployer pod for bardiharborow-2ec23007/jenkins-1: pods "jenkins-1-deploy" is forbidden: no API token found for service account bardiharborow-2ec23007/deployer, retry after the token is automatically created and added to the service account

Comment 1 Jordan Liggitt 2016-07-18 01:40:27 UTC
How long did it take for the quota to reconcile?

Comment 2 Jordan Liggitt 2016-07-18 01:41:40 UTC
And can you include the output of the following commands:

oc get sa -o yaml
oc get secrets -o name

Comment 3 Douglas Edgar 2016-07-19 23:19:14 UTC
Related to #1324179.

A user reported an error occurred in preview while trying to create a cakephp-no-database application: "Cannot create service "insomniatest3". services "insomniatest3" is forbidden: Status unknown for quota: object-counts"

Here's the requested command output for the project:

[root@preview-master-e69da ~]# oc get sa -o yaml -n insomniatest3
apiVersion: v1
items:
- apiVersion: v1
  imagePullSecrets:
  - name: builder-dockercfg-kw3xn
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:25Z
    name: builder
    namespace: insomniatest3
    resourceVersion: "55536108"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/builder
    uid: acb8e910-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: builder-dockercfg-kw3xn
  - name: builder-token-74738
- apiVersion: v1
  imagePullSecrets:
  - name: default-dockercfg-ulur7
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:25Z
    name: default
    namespace: insomniatest3
    resourceVersion: "55536101"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/default
    uid: ac9be52e-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: default-dockercfg-ulur7
  - name: default-token-necec
- apiVersion: v1
  imagePullSecrets:
  - name: deployer-dockercfg-l45dc
  kind: ServiceAccount
  metadata:
    creationTimestamp: 2016-07-17T23:46:26Z
    name: deployer
    namespace: insomniatest3
    resourceVersion: "55536113"
    selfLink: /api/v1/namespaces/insomniatest3/serviceaccounts/deployer
    uid: acd2d5b4-4c78-11e6-bba0-0ebeb1070c7f
  secrets:
  - name: deployer-dockercfg-l45dc
  - name: deployer-token-7r155
kind: List
metadata: {}

[root@preview-master-e69da ~]# oc get secrets -o name -n insomniatest3
secret/builder-dockercfg-kw3xn
secret/builder-token-66b1r
secret/builder-token-74738
secret/default-dockercfg-ulur7
secret/default-token-5937g
secret/default-token-necec
secret/deployer-dockercfg-l45dc
secret/deployer-token-7r155
secret/deployer-token-xbxug
[root@preview-master-e69da ~]#

Comment 4 Jordan Liggitt 2016-07-19 23:24:34 UTC
The quota issue is https://bugzilla.redhat.com/show_bug.cgi?id=1351705

This is possibly a secondary issue after quota reconciles

I need to know the timing at work here (how long did quota take to reconcile), and what is he current state of the project, which is why I need the requested output.

Comment 5 Jordan Liggitt 2016-07-27 19:08:59 UTC
1351705 was resolved, unable to recreate this


Note You need to log in before you can comment on or make changes to this bug.