On OpenShift Container Platform VMWare vSphere persistent volumes do not work because of missing clusterroledinging with vsphere-cloud-provider service account.
Issue
- Configured OCP to access VMWare vSphere and tried to create persistent volume using vsphere storage but it fails with following error:
I0411 19:39:55.969270 29228 rbac.go:116] RBAC DENY: user "system:serviceaccount:kube-system:vsphere-cloud-provider" groups ["system:serviceaccounts" "system:serviceaccounts:kube-system" "system:authenticated"] cannot "list" resource "nodes" cluster-wide
E0411 19:39:55.971008 29345 reflector.go:205] github.com/openshift/origin/vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/vsphere/vsphere.go:227: Failed to list *v1.Node: nodes is forbidden: User "system:serviceaccount:kube-system:vsphere-cloud-provider" cannot list nodes at the cluster scope: User "system:serviceaccount:kube-system:vsphere-cloud-provider" cannot list all nodes in the cluster
Environment
- OpenShift Container Platform 3.9
- VMWare vSphere
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.