Unable to bind service to create a secret

[jeff-phillips-18]

Attempting to create the binding for a service is failing.

Error:
Error injecting binding results for Binding "myproject/mongodb-persistent-kqwxg-cjxwq": Unexpected error in response: secrets "mongodb-persistent-kqwxg-7ieki" is forbidden: cannot set blockOwnerDeletion in this case because cannot find RESTMapping for APIVersion servicecatalog.k8s.io/v1alpha1 Kind Binding: allowed by openshift authorizer, no matches for servicecatalog.k8s.io/, Kind=Binding

Version

$ oc version
oc v1.5.0-alpha.2+631de37-4492
kubernetes v1.7.0+695f48a16f
features: Basic-Auth

Server https://127.0.0.1:8443
openshift v3.7.0-alpha.1+631de37-125
kubernetes v1.7.0+695f48a16f

[jeff-phillips-18]

@deads2k

[deads2k]

Please include the client requests being made. Normally --loglevel=8

[spadgett]

@pmorie Can you help? It's the service catalog creating this secret, so we aren't able to get the request for @deads2k. Binding is currently broken.

[pmorie]

@jeff-phillips-18 how are you deploying catalog? oc cluster up?

[pmorie]

@jpeeler is going to take a look at this.

[spadgett]

@pmorie @jpeeler Jeff and I both see this with cluster up.

$ oc cluster up --version=latest --service-catalog

[pmorie]

@spadgett can you bump the loglevel in the template to get @deads2k the info he requested?

[jpeeler]

Here the controller output at loglevel 8 with the issue reproduced:
controller-manager.txt
Additional logging:
output2-truncated.txt

[jpeeler]

I0907 15:29:42.919771       1 controller_binding.go:448] Creating/updating Secret projectname/mongodb-persistent-r4pmf-credentials-6ip7m
I0907 15:29:42.919997       1 round_trippers.go:383] GET https://172.30.0.1:443/api/v1/namespaces/projectname/secrets/mongodb-persistent-r4pmf-credentials-6ip7m
I0907 15:29:42.920036       1 round_trippers.go:390] Request Headers:
I0907 15:29:42.920055       1 round_trippers.go:393]     Accept: application/json, */*
I0907 15:29:42.920072       1 round_trippers.go:393]     User-Agent: controller-manager/v1.7.0+$Format:%h$ (linux/amd64) kubernetes/$Format/service-catalog-controller-manager
I0907 15:29:42.920088       1 round_trippers.go:393]     Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXNlcnZpY2UtY2F0YWxvZyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJzZXJ2aWNlLWNhdGFsb2ctY29udHJvbGxlci10b2tlbi0zY2xkbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJzZXJ2aWNlLWNhdGFsb2ctY29udHJvbGxlciIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImIxMzM4ZThhLTkzZTAtMTFlNy1iODEzLTUyNTQwMDI0N2I3NCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXNlcnZpY2UtY2F0YWxvZzpzZXJ2aWNlLWNhdGFsb2ctY29udHJvbGxlciJ9.Q7RyoNCXORX3oIm1tU3zRDfpfSdLRPEj33LoZ2Gt7POGoTG2RtBU5To9mKZ1l6ZpHOLxs72ecujQDnH5T0Qlnfq-pQB7jT0cQ2Y7S55iB1daaw8QPLhrZjZQOddPNP322vy5EWzEAvHT9HEMTVL7ItjDhzoNd0BeSTngY--xMCaQHJBEyybrKIWxl3-cTYai-jjrfOzVfgpJWftcrqveyIUp7wUnRC_U6UTfCtArg85g3ecDzZ7qNC9wUq-U5O2WjeSjokXYE0znjrH6TlA4WUtb5qoGl8ljj3bytnqfQCLWNxFkN2AuVJN8DE9y6kRCJGk2MBYU4QstHtzyVqS0gA
I0907 15:29:42.929911       1 round_trippers.go:408] Response Status: 404 Not Found in 9 milliseconds
I0907 15:29:42.929935       1 round_trippers.go:411] Response Headers:
I0907 15:29:42.929942       1 round_trippers.go:414]     Content-Type: application/json
I0907 15:29:42.929948       1 round_trippers.go:414]     Content-Length: 258
I0907 15:29:42.929952       1 round_trippers.go:414]     Date: Thu, 07 Sep 2017 15:29:42 GMT
I0907 15:29:42.929957       1 round_trippers.go:414]     Cache-Control: no-store
I0907 15:29:42.929991       1 request.go:991] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"secrets \"mongodb-persistent-r4pmf-credentials-6ip7m\" not found","reason":"NotFound","details":{"name":"mongodb-persistent-r4pmf-credentials-6ip7m","kind":"secrets"},"code":404}
I0907 15:29:42.930189       1 request.go:991] Request Body: {"kind":"Secret","apiVersion":"v1","metadata":{"name":"mongodb-persistent-r4pmf-credentials-6ip7m","namespace":"projectname","creationTimestamp":null,"ownerReferences":[{"apiVersion":"servicecatalog.k8s.io/v1alpha1","kind":"Binding","name":"mongodb-persistent-r4pmf-d7swv","uid":"1356dab8-93e1-11e7-a794-0242ac110006","controller":true,"blockOwnerDeletion":true}]},"data":{"admin_password":"aExRd3hoUHZiRXRmd2hTVw==","database_name":"c2FtcGxlZGI=","password":"SllrVVd2V1c2V25vUmdEMA==","uri":"bW9uZ29kYjovLzE3Mi4zMC4yLjE2MjoyNzAxNw==","username":"dXNlclRGWQ=="}}
I0907 15:29:42.930243       1 round_trippers.go:383] POST https://172.30.0.1:443/api/v1/namespaces/projectname/secrets
I0907 15:29:42.930255       1 round_trippers.go:390] Request Headers:
I0907 15:29:42.930263       1 round_trippers.go:393]     Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXNlcnZpY2UtY2F0YWxvZyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJzZXJ2aWNlLWNhdGFsb2ctY29udHJvbGxlci10b2tlbi0zY2xkbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJzZXJ2aWNlLWNhdGFsb2ctY29udHJvbGxlciIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImIxMzM4ZThhLTkzZTAtMTFlNy1iODEzLTUyNTQwMDI0N2I3NCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXNlcnZpY2UtY2F0YWxvZzpzZXJ2aWNlLWNhdGFsb2ctY29udHJvbGxlciJ9.Q7RyoNCXORX3oIm1tU3zRDfpfSdLRPEj33LoZ2Gt7POGoTG2RtBU5To9mKZ1l6ZpHOLxs72ecujQDnH5T0Qlnfq-pQB7jT0cQ2Y7S55iB1daaw8QPLhrZjZQOddPNP322vy5EWzEAvHT9HEMTVL7ItjDhzoNd0BeSTngY--xMCaQHJBEyybrKIWxl3-cTYai-jjrfOzVfgpJWftcrqveyIUp7wUnRC_U6UTfCtArg85g3ecDzZ7qNC9wUq-U5O2WjeSjokXYE0znjrH6TlA4WUtb5qoGl8ljj3bytnqfQCLWNxFkN2AuVJN8DE9y6kRCJGk2MBYU4QstHtzyVqS0gA
I0907 15:29:42.930272       1 round_trippers.go:393]     Accept: application/json, */*
I0907 15:29:42.930280       1 round_trippers.go:393]     Content-Type: application/json
I0907 15:29:42.930287       1 round_trippers.go:393]     User-Agent: controller-manager/v1.7.0+$Format:%h$ (linux/amd64) kubernetes/$Format/service-catalog-controller-manager
I0907 15:29:42.940554       1 round_trippers.go:408] Response Status: 403 Forbidden in 10 milliseconds
I0907 15:29:42.940580       1 round_trippers.go:411] Response Headers:
I0907 15:29:42.940588       1 round_trippers.go:414]     Cache-Control: no-store
I0907 15:29:42.940593       1 round_trippers.go:414]     Content-Type: application/json
I0907 15:29:42.940598       1 round_trippers.go:414]     Content-Length: 483
I0907 15:29:42.940604       1 round_trippers.go:414]     Date: Thu, 07 Sep 2017 15:29:42 GMT
I0907 15:29:42.940652       1 request.go:991] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"secrets \"mongodb-persistent-r4pmf-credentials-6ip7m\" is forbidden: cannot set blockOwnerDeletion in this case because cannot find RESTMapping for APIVersion servicecatalog.k8s.io/v1alpha1 Kind Binding: allowed by openshift authorizer, no matches for servicecatalog.k8s.io/, Kind=Binding","reason":"Forbidden","details":{"name":"mongodb-persistent-r4pmf-credentials-6ip7m","kind":"secrets"},"code":403}
W0907 15:29:42.940833       1 controller_binding.go:311] Error injecting binding results for Binding "projectname/mongodb-persistent-r4pmf-d7swv": Unexpected error in response: secrets "mongodb-persistent-r4pmf-credentials-6ip7m" is forbidden: cannot set blockOwnerDeletion in this case because cannot find RESTMapping for APIVersion servicecatalog.k8s.io/v1alpha1 Kind Binding: allowed by openshift authorizer, no matches for servicecatalog.k8s.io/, Kind=Binding
I0907 15:29:42.940859       1 controller_binding.go:545] Setting Binding 'projectname/mongodb-persistent-r4pmf-d7swv' condition "Ready" to False
I0907 15:29:42.940888       1 controller_binding.go:584] Updating status for Binding projectname/mongodb-persistent-r4pmf-d7swv
I0907 15:29:42.940989       1 request.go:991] Request Body: {"kind":"Binding","apiVersion":"servicecatalog.k8s.io/v1alpha1","metadata":{"name":"mongodb-persistent-r4pmf-d7swv","generateName":"mongodb-persistent-r4pmf-","namespace":"projectname","selfLink":"/apis/servicecatalog.k8s.io/v1alpha1/namespaces/projectname/bindings/mongodb-persistent-r4pmf-d7swv","uid":"1356dab8-93e1-11e7-a794-0242ac110006","resourceVersion":"96","creationTimestamp":"2017-09-07T15:27:35Z","finalizers":["kubernetes-incubator/service-catalog"]},"spec":{"instanceRef":{"name":"mongodb-persistent-r4pmf"},"parametersFrom":[{"secretKeyRef":{"name":"mongodb-persistent-r4pmf-bind-parameters-d3xvt","key":"parameters"}}],"secretName":"mongodb-persistent-r4pmf-credentials-6ip7m","externalID":"274a04e7-4262-489d-910b-11482fd36d89"},"status":{"conditions":[{"type":"Ready","status":"False","lastTransitionTime":"2017-09-07T15:27:36Z","reason":"ErrorInjectingBindResult","message":"Error injecting bind result Error injecting binding results for Binding \"projectname/mongodb-persistent-r4pmf-d7swv\": Unexpected error in response: secrets \"mongodb-persistent-r4pmf-credentials-6ip7m\" is forbidden: cannot set blockOwnerDeletion in this case because cannot find RESTMapping for APIVersion servicecatalog.k8s.io/v1alpha1 Kind Binding: allowed by openshift authorizer, no matches for servicecatalog.k8s.io/, Kind=Binding"}]}}

[djzager]

Is this because they are now called ServiceInstanceCredential? https://github.com/openshift/service-catalog/blob/master/contrib/examples/apiserver/binding.yaml

[pmorie]

@djzager no - that change hasn't landed in origin yet.