missing roles

[bvv906]

Describe the bug

Volume migration stuck,

"volumemigrationjob-a8ebd411-ef02-11ed-bff3-0a580a8200cb", "namespace": "cnsmanager", "TraceId": "134452f3-561d-4be3-ad4d-1ab4f8d0fe27", "volume": "6b56ced2-2eaf-4eab-800b-d74b5e8dd63a", "error": "volumemigrationtasks.cnsmanager.cns.vmware.com "volumemigrationtask-cd71f397-ef02-11ed-bff3-0a580a8200cb" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: RBAC: clusterrole.rbac.authorization.k8s.io "psp:vmware-system-privileged" not found, "}

deploy-template.yaml have only binding, not the role

Reproduction steps

1. start volume migration
2. see logs of a cns-manager

...

Expected behavior

succesful migration

Additional context

No response

[gohilankit]

@bvv906 Can you provide more details about your environment - like which Kubernetes distribution and version?

The ClusterRole psp:vmware-system-privileged pertains to vSphere with Tanzu deployments, so we will get rid of that RoleBinding in the upcoming release. But storage vMotion doesn't depend on that RoleBinding. Please try removing the RoleBinding from deploy yaml, and see if the migration works.

[gohilankit]

I just tried migrating a volume and it works even without ClusterRole psp:vmware-system-privileged being present in my cluster.

root@k8s-control-540-1683580564:~/manifests# kubectl get RoleBinding -A
NAMESPACE           NAME                                                    ROLE                                                  AGE
cns-manager         cns-manager                                             ClusterRole/psp:vmware-system-privileged              18m   <-----
.
.
.

root@k8s-control-540-1683580564:~/manifests# kubectl get ClusterRole psp:vmware-system-privileged
Error from server (NotFound): clusterroles.rbac.authorization.k8s.io "psp:vmware-system-privileged" not found

[draakuns]

@bvv906 Can you provide more details about your environment - like which Kubernetes distribution and version?

The ClusterRole psp:vmware-system-privileged pertains to vSphere with Tanzu deployments, so we will get rid of that RoleBinding in the upcoming release. But storage vMotion doesn't depend on that RoleBinding. Please try removing the RoleBinding from deploy yaml, and see if the migration works.

Hi @gohilankit , latest 0.3.0 version still relies on psp, and for us using Openshift or other kubernetes we just can't install. Can you provide a valid CR for it in the meanwhile that a release fixes it, please?
It's been a year so I hope I can avoid just using an empty CR and filling up the gaps myself with trial-and-error.

Thanks!