Error while installing with Kubeflow latest instructions on openshift

[akchinSTC]

Following the instructions here: https://www.kubeflow.org/docs/distributions/openshift/install-kubeflow/

I get the following error after executing

while ! kustomize build openshift/example/istio | kubectl apply -f -; do echo "Retrying to apply resources"; sleep 10; done

$ while ! kustomize build openshift/example/istio | oc  apply -f -; do echo "Retrying to apply resources"; sleep 10; done
Error: multiple matches for rbac.authorization.k8s.io_v1_Role|~X|leader-election-role:
  [rbac.authorization.k8s.io_v1_Role|kubeflow|notebook-controller-leader-election-role
 rbac.authorization.k8s.io_v1_Role|kubeflow|profiles-leader-election-role
]
error: no objects passed to apply
Retrying to apply resources

openshift version: 4.9
Kustomize version : 3.2.0
kubectl version : 1.20.0 (as i understand it, 1.20+ comes prepackaged with kustomize 4 which is incompatible)

[akchinSTC]

@LaVLaS - any pointers would be appreciated =)

[mgazz]

Hello,

I am encountering the exact same problem.

From a quick look the Role leader-election-role seems to be defined in multiple places:

• ./apps/profiles/upstream/rbac/leader_election_role.yaml
• ./apps/jupyter/notebook-controller/upstream/rbac/leader_election_role.yaml
• ./apps/tensorboard/tensorboard-controller/upstream/rbac/leader_election_role.yaml

The first two are identical, so I removed one of the definitions. This can be done for instance by commenting the resource in leader_election_role.yaml in ./apps/jupyter/notebook-controller/upstream/rbac/kustomization.yaml. Below the resulting content:

resources:
- role.yaml
- role_binding.yaml
#- leader_election_role.yaml
- leader_election_role_binding.yaml
- user_cluster_roles.yaml
# Comment the following 3 lines if you want to disable
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
# which protects your /metrics endpoint.
# - auth_proxy_service.yaml
# - auth_proxy_role.yaml
# - auth_proxy_role_binding.yaml

The command kustomize build openshift/example/istio should now render the configuration without errors.

The rolebinding notebook-controller-leader-election-rolebinding can still be created because it references the role leader-election-role instead of notebook-controller-leader-election-role. Plus all roles/rolebindings are in the same namespace (kubeflow). Following a snippet from the rendered configuration showing the rolebinding:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: notebook-controller
    kustomize.component: notebook-controller
  name: notebook-controller-leader-election-rolebinding
  namespace: kubeflow
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: leader-election-role
subjects:
- kind: ServiceAccount
  name: notebook-controller-service-account
  namespace: kubeflow

As a note, I used kustomize v3.2.1 as reported in go.mod. Maybe this should be updated in the documentation?