Hi community. I already set clusterrole rules for flyte in values.yaml like:

rbac:
  create: true
  extraRules:
  - apiGroups:
    - "*"
    resources:
    - serviceaccounts
    verbs:
    - create
    - get
    - list
    - patch
    - update
    - watch
    - delete
  - apiGroups:
    - '*'
    resources:
    - mutatingwebhookconfigurations
    - mutatingwebhookconfigurations/finalizers
    - secrets
    - pods
    - pods/finalizers
    - replicasets
    - replicasets/finalizers
    - deployments
    - deployments/finalizers
    - finalizers
    - rbacdefinitions/finalizers
    verbs:
    - create
    - get
    - list
    - patch
    - update
    - watch
    - delete

but when I run pyflyte remote I got error in task:

pods "f53fe3a9ddee948c09cc-n0-0" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>

full error message like this picture, sorry to bother, and thank for help

@quaint-accountant-26543, thanks for your persistence in getting Flyte running on OKD! A few suggestions, questions: 1. Let's try a bruteforce approach first and backtrack from there. What happens if you set this on all finalizers (i.e.

"*/finalizers"

)? If this works we can inspect the resources created and adjust it from there. 2. how are you installing the flyte-binary helm chart on an OKD cluster?

@high-accountant-32689 thank for reply, I add the `"*/finalilzers"`in rbac rules and it work! the error message is different. this is my values.yaml on OKD

configuration:
  database:
    username: flyte
    password: F1yteAdmin
    host: postgres.eric-mlops.svc.cluster.local
    dbname: flyte
  storage:
    type: minio
    metadataContainer: flyte #This is the default bucket created with Minio. Controlled by the MINIO_DEFAULT_BUCKETS env var in the local-flyte-resources.yaml manifest
    userDataContainer: flyte
    provider: s3
    providerConfig:
      s3:
        authType: "accesskey"
        endpoint: "<http://minio.eric-mlops.svc.cluster.local:9000>" 
        accessKey: "minio"
        secretKey: "miniostorage" #If you need to change this parameters, refer to the local-flyte-resources.yaml manifest and adjust the MINIO_ROOT_PASSWORD env var
        disableSSL: "true"
        secure: "false"
        v2Signing: "true"

  # inlineSecretRef: flyte-binary-inline-config-secret
  # inline:
  #   plugins:
  #     k8s:
  #       inject-finalizer: true
  #       default-env-vars:
  #       - FLYTE_AWS_ENDPOINT: "<http://minio.eric-mlops.svc.cluster.local:9000>"
  #       - FLYTE_AWS_ACCESS_KEY_ID: "minio"
  #       - FLYTE_AWS_SECRET_ACCESS_KEY: "miniostorage" #Use the same value as the MINIO_ROOT_PASSWORD


  # Learn more: <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-EKS-logs.html>
  logging:
    level: 1

clusterResourceTemplates:
  inline:
    #This section automates the creation of the project-domain namespaces
    001_namespace.yaml: |
      apiVersion: v1
      kind: Namespace
      metadata:
        name: '{{ namespace }}'
    # This block performs the automated annotation of KSAs across all project-domain namespaces
    002_serviceaccount.yaml: |
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: flyte-backend-flyte-binary
        namespace: '{{ namespace }}'
# annotations:
#     <http://eks.amazonaws.com/role-arn|eks.amazonaws.com/role-arn>: '{{ defaultIamRole }}'
rbac:
  create: true
  extraRules:
  - apiGroups:
    - "*"
    resources:
    - serviceaccounts
    verbs:
    - create
    - get
    - list
    - patch
    - update
    - watch
    - delete
  - apiGroups:
    - '*'
    resources:
    - mutatingwebhookconfigurations
    - mutatingwebhookconfigurations/finalizers
    - secrets
    - pods
    - pods/finalizers
    - replicasets
    - replicasets/finalizers
    - deployments
    - deployments/finalizers
    - finalizers
    - rbacdefinitions/finalizers
    - "*/finalizers"
    verbs:
    - '*'

serviceAccount:
  create: true
  namespace: eric-mlops

service:
  type: LoadBalancer

and I run

helm install flyte-backend flyteorg/flyte-binary --namespace eric-mlops --values okd-starter.yaml