New RunLLM response generated: >>>*# Question* Sorry to bother, I am installing flyte-binary on OKD, I already set extraRules in values.yaml like:

rbac:
  create: true
  extraRules:
    - apiGroups:
      - ""
      resources:
      - serviceaccounts
      verbs:
      - create
      - get
      - list
      - patch
      - update
    - apiGroups: ["<http://admissionregistration.k8s.io|admissionregistration.k8s.io>"]
      resources: ["mutatingwebhookconfigurations/finalizers"]
      verbs: ["update"]
    - apiGroups: [""]
      resources: ["finalizers"]
      verbs: ["update"]
serviceAccount:
  create: true
  namespace: eric-mlops

but the flyte-binary pod throw an error:

{"json":{"src":"start.go:226"},"level":"panic","msg":"Failed to start Propeller, err: failed to create mutatingwebhookconfiguration. Error: <http://mutatingwebhookconfigurations.admissionregistration.k8s.io|mutatingwebhookconfigurations.admissionregistration.k8s.io> \"flyte-backend-flyte-binary-webhook\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>","ts":"2024-07-23T06:23:47Z"}
{"json":{"routine":"worker-6","src":"workers.go:118"},"level":"info","msg":"Exiting Worker","ts":"2024-07-23T06:23:47Z"}
panic: (*logrus.Entry) 0xc004cadd50

How to fix this issue, please? # Answer The error you're encountering is due to insufficient permissions for the Flyte service account to set finalizers on the

mutatingwebhookconfigurations

resource. This issue can be resolved by explicitly granting the necessary permissions to the Flyte service account. According to this GitHub pull request, you need to ensure that the Flyte service account has the

replicasets/finalizers

permission. Here is an example of how to update your

values.yaml

to include this permission:

rbac:
  create: true
  extraRules:
    - apiGroups:
      - ""
      resources:
      - serviceaccounts
      verbs:
      - create
      - get
      - list
      - patch
      - update
    - apiGroups: ["admissionregistration.k8s.io"]
      resources: ["mutatingwebhookconfigurations/finalizers"]
      verbs: ["update"]
    - apiGroups: [""]
      resources: ["finalizers"]
      verbs: ["update"]
    - apiGroups: ["apps"]
      resources: ["replicasets/finalizers"]
      verbs: ["update"]
serviceAccount:
  create: true
  namespace: eric-mlops

After updating the

values.yaml

file, redeploy the Helm chart to apply the changes. Would you like more details on any specific part of this process? Sources: - GitHub Pull Request #2165 Slack Link https://flyte-org.slack.com/archives/CP2HDHKE1/p1721716173.600329 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.