Syndesis: Problem with privileges during installation

[mkralik3]

This is a...

[ ] Feature request
[ ] Regression (a behavior that used to work and stopped working in a new release)
[x] Bug report  
[ ] Documentation issue or request

Description

The installation of Syndesis from the tag _1.8.1-20190618_ or _1.7.0_ doesn't work.
syndesis minishift --install --project syndesis --tag 1.8.1-20190618
syndesis minishift --install --project syndesis --tag 1.7.0
All pods are terminating and creating in a loop.
The operator contains lots of errors like:

{"level":"error","ts":1560864997.8587072,"logger":"kubebuilder.controller","msg":"Reconciler error","controller":"syndesis-controller","request":"syndesis/app","error":"roles.rbac.authorization.k8s.io \"syndesis-editor\" is forbidden: attempt to grant extra privileges:
...

The full log:
syndesis-operator-1-xh9gj.log

After some time, the pods look ready, however in the server is an issue:

2019-06-18 13:47:13.319 ERROR [-,,,] 1 --- [ning]: pollPods] i.s.s.l.j.c.ActivityTrackingController   : Unexpected Error occurred.
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://kubernetes.default.svc/api/v1/namespaces/syndesis/pods?labelSelector=syndesis.io/component%3Dintegration . Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:syndesis:syndesis-server" cannot list pods in the namespace "syndesis": no RBAC policy matched.
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:472) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:409) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:381) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:344) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:328) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:584) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:49) ~[kubernetes-client-3.1.12.fuse-730022.jar!/:na]
    at io.syndesis.server.logging.jsondb.controller.ActivityTrackingController.listPods(ActivityTrackingController.java:327) ~[server-logging-jsondb-1.7.0.jar!/:1.7.0]
    at io.syndesis.server.logging.jsondb.controller.ActivityTrackingController.pollPods(ActivityTrackingController.java:271) ~[server-logging-jsondb-1.7.0.jar!/:1.7.0]
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[na:1.8.0_151]
    at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) ~[na:1.8.0_151]
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) ~[na:1.8.0_151]
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) ~[na:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_151]
    at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_151]

The symptoms look similar to https://github.com/syndesisio/syndesis/issues/4717

QE testing is blocked by this

[tplevko]

@heiko-braun QE testing is blocked by this. Possible cause: https://github.com/syndesisio/syndesis/commit/309e5f94f52685c6df72b997a57a9d2cecec5d77

[lgarciaaco]

@tplevko which user you using?

[tplevko]

@lgarciaaco we use user with cluster admin rights.

[lgarciaaco]

@tplevko yea initially I thought it was only happening with developer user but no ... 1.7.x should be fine now ...

[tplevko]

@lgarciaaco in that case would a rebuild of 1.7.x be possible so we can verify? Thanks!

[lgarciaaco]

@tplevko build is done ... 1.7.1

[mkralik3]

@lgarciaaco
Thanks, the 1.7.1 and master works properly via command syndesis minishift --intall --tag <TAG>. I have closed this issue.