I can not have the cluster imported into hub.

[nobody4t]

Hi Michael,

I followed your doc in Ubuntu. But I failed to imported the managed cluster to hub.
I left out the steps of configuring the api server for mac.

When I configured the boot strap secret in cluster, I did not get the csr as expected.
But the registration pods are up and work-agent failed with `Crashbackoff"

klusterlet-registration-agent-6c5b84c7d7-bmldq   1/1     Running            6          3h28m
klusterlet-registration-agent-6c5b84c7d7-c9fkv   1/1     Running            5          3h28m
klusterlet-registration-agent-6c5b84c7d7-cjmpc   1/1     Running            6          3h28m
klusterlet-work-agent-5458c8fdd8-999kr           1/1     Running            35         3h28m
klusterlet-work-agent-5458c8fdd8-bd9f2           0/1     CrashLoopBackOff   36         3h28m
klusterlet-work-agent-5458c8fdd8-k2hvd           0/1     CrashLoopBackOff   34         3h28m

The log from one of the pods:

graceful termination failed, controllers failed with error: stat /spoke/hub-kubeconfig/kubeconfig: no such file or directory

And the readiness probe failed again and again.

I found the secrets

bootstrap-hub-kubeconfig                 Opaque                                1      3h17m
default-token-x2v2b                      kubernetes.io/service-account-token   3      3h31m
hub-kubeconfig-secret                    Opaque                                1      3h31m
klusterlet-registration-sa-token-sczv6   kubernetes.io/service-account-token   3      3h31m
klusterlet-work-sa-token-ms7hw           kubernetes.io/service-account-token   3      3h31m

I inspected the secret hub-kubeconfig-secret, and its data is empty. And you can see its timestamps is the same as other secret and older than bootstrap. So I guess it is created when to create klusterlet and not updated later?

kg secret -n open-cluster-management-agent hub-kubeconfig-secret -ojson | jq '.data'
{
  "placeholder": "cGxhY2Vob2xkZXI="
}

At last I found the error in Klusterlet status:

Failed to create &SelfSubjectAccessReview{ObjectMeta:{      0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[] map[] [] []  []},Spec:SelfSubjectAccessReviewSpec{ResourceAttributes:&ResourceAttributes{Namespace:,Verb:create,Group:cluster.open-cluster-management.io,Version:,Resource:managedclusters,Subresource:,Name:,},NonResourceAttributes:nil,},Status:SubjectAccessReviewStatus{Allowed:false,Reason:,EvaluationError:,Denied:false,},} with bootstrap secret "open-cluster-management-agent" "bootstrap-hub-kubeconfig": Post "https://127.0.0.1:35545/apis/authorization.k8s.io/v1/selfsubjectaccessreviews": dial tcp 127.0.0.1:35545: connect: connection refused
Failed to get kubeconfig from `kubectl get secret -n "open-cluster-management-agent" "hub-kubeconfig-secret" -ojsonpath='{.data.kubeconfig}'`. This is set by the klusterlet registration deployment, but the CSR must be approved by the cluster-admin on the hub.

I think this should be the same cause.

Did I miss anything? Or it is a bug for regsitration?