SCB Scan creation does not seem to work properly within a OVH Cluster  #663

Activity

1. ineluki00

   added

   bugBugsBugs

   on Sep 21, 2021
2. J12934 commented on Sep 21, 2021

   

   J12934

   on Sep 21, 2021

   Member

   More actions

   Hey, yeah if the state stays empty that pretty likely because the operator isn't running correctly.

   Can you see if the operator is running and check the logs?

   kubectl --namespace securecodebox-system get pods
   kubectl --namespace securecodebox-system logs deployment/securecodebox-controller-manager
3. rfelber

   added

   questionFurther information is requestedFurther information is requested

   on Sep 22, 2021
4. rfelber

   changed the title [-]Scan creation does not create job...[/-] [+]SCB Scan creation does not seem to work properly within a OVH Cluster [/+] on Sep 22, 2021
5. ineluki00 commented on Sep 22, 2021

   

   ineluki00

   on Sep 22, 2021

   Author

   More actions

   Hi,

   effectively it seems that securecodebox-operator service account does not have access to configmaps...

   leaderelection.go:325] error retrieving resource lock securecodebox-system/xxxxxxxx.securecodebox.io: configmaps "xxxxxxxxxx.securecodebox.io" is forbidden: User "system:serviceaccount:securecodebox-system:securecodebox-operator" cannot get resource "configmaps" in API group "" in the namespace "securecodebox-system"

   From what i can see, the 'manager-rolebinding' ClusterRoleBinding is present and the related 'manager-role' ClusterRole too but the ClusterRole does not specify any configmaps resource. But when i add it to 'manager-role'

   - apiGroups:
     - ""
     resources:
     - pods
     - configmaps <-- +
     verbs:
     - get

   and redeploy securecodebox-controller-manager i get another error:

   leaderelection.go:329] error initially creating leader election record: configmaps is forbidden: User "system:serviceaccount:securecodebox-system:securecodebox-operator" cannot create resource "configmaps in API group "" in the namespace "securecodebox-system"

   So i moved previously added line to another block with create verb and then i got another error:

   leaderelection.go:325] error retrieving resource lock securecodebox-system/xxxxxxx.securecodebox.io: leases.coordination.k8s.io "xxxxxxx.securecodebox.io" is forbidden: User "system.serviceaccount:securecodebox-operator" cannot get resource "leases" in API group "coordination.k8s.io" in the namespace "securecodebox-system"

   It seems like if the 'leader-election-role' content was not linked with the controller while it is present...
   Is there a problem with multiple configmaps load ?
   I could try to merge leader-election-role in manager-role but it would make a non-sense...

   Thanks in advance
6. J12934 commented on Sep 22, 2021

   

   J12934

   on Sep 22, 2021

   Member

   More actions

   Hi thank you for the extensive investigation 👍

   I'm still not sure why this is making issues in this cluster, the leader-election-role is usually bound to the scb operator service account using the RoleBinding here: https://github.com/secureCodeBox/secureCodeBox/blob/main/operator/templates/rbac/leader_election_role_binding.yaml

   Is that rolebinding not present in the cluster, or just not working correctly?
   If it is present, but not working correctly is there a way to update the cluster to a newer 1.20 patch release? Just to make sure it isn't an actual bug in Kubernetes (even thought it's probably unlikely).
7. J12934 commented on Jan 14, 2022

   

   J12934

   on Jan 14, 2022

   Member

   More actions

   Closing this now.
   If you have found a solution or have more info to debug this further feel free to reopen 🙏
8. J12934

   closed this as completedon Jan 14, 2022