permission denied in custom catalog pod

[ryandawsonuk]

The pod for my custom catalog is giving this error:

Error: open db-254798428: permission denied
Usage:
  opm registry serve [flags]

This is the whole error. Not sure why this has just started happening. Presumably I've changed something but it's hard to tell from the error what I could have changed.

[ryandawsonuk]

I've tried adding extra permission to the service account but it's not making any difference. Also tried going back to an older version of my catalog definition and that doesn't help either.

The only thing I can think of is that I ran oc adm policy add-scc-to-user hostaccess for a different serviceaccount in a different namespace. Struggling to see how that could cause this though.

The same CatalogSource image works on a kind cluster so must be a problem with the openshift cluster.

[ryandawsonuk]

Now tried the same CatalogSource on a new openshift cluster and it works there. Problem must be a permission change that I made to the other cluster.

[ecordell]

@ryandawsonuk did you determine what the root cause was? We may be missing a requirement that we need to document.

[ecordell]

Please open a new issue with more details if you have time to find them. Thanks!

[ryandawsonuk]

@ecordell I actually just found out some more about this. It's not caused by the permissions change above. I created a new cluster and had everything working. Then I installed argo and minio and now I've got the problem above again.

I will try removing what I've installed and let you know. Currently suspecting something that the argo install does but not sure what.

[ryandawsonuk]

Yeah deleting those installs got it working again.

Problem is not argo. It's the helm install of the minio helm chart. When that helm chart is installed (in the minio-system namespace) then I get the above error in the catalog pod.

The minio helm chart does support deployment to openshift. Actually I can use the minio features successfully. Minio looks happy. The problem is that it breaks my catalog pod somehow.

[ryandawsonuk]

Given that this is a permissions error it is probably caused by those SecurityContextConstraints.

@ecordell now not sure whether to raise an issue here or with minio. Maybe the authors of that PR will have a view. @Arano-kai ? @harshavardhana ?

[harshavardhana]

@ryandawsonuk for openshift it is required you create all the security constraints and role bindings properly to use this feature.

Error: open db-254798428: permission denied
Usage:
opm registry serve [flags]

The error here is that opm registry doesn't have read permissions to the file that you are pointing to.