Openshift

[vincoaeris]

Has anyone managed to get Clabernetes working on Openshift?

I haven't been able to get the manager pods to to start. Their logs show the below:

INFO | clabernetes | initializing cluster info
INFO | clabernetes | begin prepare...
INFO | clabernetes | preparing certificates...
INFO | clabernetes | preparing scheme...
INFO | clabernetes | starting http manager...
INFO | clabernetes | start leader election
INFO | klog | klog leaderelection.go:254: attempting to acquire leader lease c9s/clabernetes-manager...
CRITICAL | http-manager | http manager server has failed, error: open /clabernetes/certificates/webhook/tls.crt: permission denied
E1019 23:34:42.291760 1 leaderelection.go:436] error retrieving resource lock c9s/clabernetes-manager: Get "https://172.30.0.1:443/apis/coordination.k8s.io/v1/namespaces/c9s/leases/clabernetes-manager": context canceled
INFO | klog | klog leaderelection.go:436: error retrieving resource lock c9s/clabernetes-manager: Get "https://172.30.0.1:443/apis/coordination.k8s.io/v1/namespaces/c9s/leases/clabernetes-manager": context canceled
INFO | klog | klog leaderelection.go:436: error retrieving resource lock c9s/clabernetes-manager: Get "https://172.30.0.1:443/apis/coordination.k8s.io/v1/namespaces/c9s/leases/clabernetes-manager": context canceled
INFO | clabernetes | stopping clabernetes...
INFO | klog | klog leaderelection.go:436: error retrieving resource lock c9s/clabernetes-manager: Get "https://172.30.0.1:443/apis/coordination.k8s.io/v1/namespaces/c9s/leases/clabernetes-manager": context canceled

[carlmontanari]

What version? There were changes a while back around permissions for the cert stuff and at least two folks I know have ran it on open shift after that change. I think there is/was some other change on the namespace (like an annotation or something) that was needed to shut up some open shift extra security thing. Will search a bit tomorrow to see if I can find what that was, but yeah generally sounds like an open shift specific security thing… because open shift basically :)

[vincoaeris]

Wow thanks for the quick response! Currently running OKD 4.16.0-0.okd-scos-2024-08-21-155613 and Clabernetes 0.2.4. The same permission denied error is seen whether installing with helm or using the manifests under the charts/templates folder.

[carlmontanari]

Yeah ok lemme poke around tomorrow… maybe/hopefully I can find the annotation thing and hopefully that’s it. Will keep you posted

[hellt]

I think this was it

oc adm policy add-scc-to-user anyuid -z clabernetes-service-account```

re openshift/clabernetes

[vincoaeris]

That got it working, thank you guys very much for your help!