Decision Intelligence Client Managed Software instance creation fails

Symptoms

Decision Intelligence Client Managed Software operator fails to create a new instance with an error message ibm-licensing-upload-token' secret does not exist.

Causes

This problem occurs because Role and RoleBinding for the ibm-licensing-operator are not copied in the namespace where Decision Intelligence is installed.

Diagnosing the problem

Check the logs for the Decision Intelligence operator by entering the following command:

kubectl logs ibm-ads-operator-<pod-id>

Check whether an error message is displayed. For example:

2024-05-24T12:31:09.870Z	ERROR	controllers.ADS	ibm-licensing-upload-token' secret does not exist.	{"NamespacedName": {"name":"ads-standalone","namespace":"ads"}, "requestNamespace": "ads", "requestName": "ads-standalone", "Kind": "AutomationDecisionService.ads.ibm.com", "error": "ibm-licensing-upload-token' secret does not exist."}

Enter the following command to check the logs of the Operator Lifecycle Manager:

kubectl logs -n olm olm-operator-860cf6f875-t9l8

Check whether the log contains the following messages:

E0416 12:16:41.110414       1 reflector.go:140] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: Failed to watch *v1.Deployment: failed to list *v1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "deployments" in API group "apps" in the namespace "ads"
W0416 12:16:58.315502       1 reflector.go:424] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "secrets" in API group "" in the namespace "ads"
E0416 12:16:58.315552       1 reflector.go:140] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: Failed to watch *v1.Secret: failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "secrets" in API group "" in the namespace "ads"
W0416 12:17:28.387666       1 reflector.go:424] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: failed to list *v1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "deployments" in API group "apps" in the namespace "ads"
E0416 12:17:28.387735       1 reflector.go:140] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: Failed to watch *v1.Deployment: failed to list *v1.Deployment: deployments.apps is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "deployments" in API group "apps" in the namespace "ads"
W0416 12:17:36.722936       1 reflector.go:424] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: failed to list *v1.Pod: pods is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "pods" in API group "" in the namespace "ads"
E0416 12:17:36.722993       1 reflector.go:140] pkg/mod/k8s.io/client-go@v0.25.7/tools/cache/reflector.go:169: Failed to watch *v1.Pod: failed to list *v1.Pod: pods is forbidden: User "system:serviceaccount:ibm-licensing:ibm-licensing-operator" cannot list resource "pods" in API group "" in the namespace "ads"

To verify your version of the Operator Lifecycle Manager, enter the following command:

kubectl get csv packageserver -n olm

Resolving the problem

The problem occurs due to an outdated Operator Lifecycle Manager version. Install the Operator Lifecycle Manager version 0.27.0 or later.