Deleting fails with: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on

[lburgazzoli]

When we delete a resource, we are hitting this error:

2018-07-23 10:26:53.114 ERROR [-,40eef3b7be856afd,40eef3b7be856afd,false] 1 --- [  XNIO-3 task-2] .s.e.v.h.e.SyndesisServerExceptionMapper : Internal Server Exception. Failure executing: PATCH at: https://openshift.default.svc/api/v1/namespaces/syndesis/replicationcontrollers/i-salesforce-5 . Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. replicationcontrollers "i-salesforce-5" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: User "system:serviceaccount:syndesis:syndesis-server" cannot update deploymentconfigs/finalizers.apps.openshift.io in project "syndesis", <nil>.
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://openshift.default.svc/api/v1/namespaces/syndesis/replicationcontrollers/i-salesforce-5 . Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. replicationcontrollers "i-salesforce-5" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: User "system:serviceaccount:syndesis:syndesis-server" cannot update deploymentconfigs/finalizers.apps.openshift.io in project "syndesis", <nil>.
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:470) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:407) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:379) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:343) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handlePatch(OperationSupport.java:279) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handlePatch(BaseOperation.java:783) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.HasMetadataOperation$3.apply(HasMetadataOperation.java:156) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.HasMetadataOperation$3.apply(HasMetadataOperation.java:152) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.api.model.DoneableReplicationController.done(DoneableReplicationController.java:26) ~[kubernetes-model-2.0.10.jar!/:2.0.10]
	at io.fabric8.kubernetes.api.model.DoneableReplicationController.done(DoneableReplicationController.java:5) ~[kubernetes-model-2.0.10.jar!/:2.0.10]
	at io.fabric8.kubernetes.client.dsl.base.HasMetadataOperation.patch(HasMetadataOperation.java:163) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.internal.RollableScalableResourceOperation.patch(RollableScalableResourceOperation.java:185) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.HasMetadataOperation$1.apply(HasMetadataOperation.java:60) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.HasMetadataOperation$1.apply(HasMetadataOperation.java:50) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.api.model.DoneableReplicationController.done(DoneableReplicationController.java:26) ~[kubernetes-model-2.0.10.jar!/:2.0.10]
	at io.fabric8.kubernetes.client.dsl.internal.ReplicationControllerOperationsImpl.withReplicas(ReplicationControllerOperationsImpl.java:85) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.internal.ReplicationControllerOperationsImpl.withReplicas(ReplicationControllerOperationsImpl.java:42) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.internal.RollableScalableResourceOperation.scale(RollableScalableResourceOperation.java:77) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.internal.RollableScalableResourceOperation.scale(RollableScalableResourceOperation.java:45) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.internal.ScalableReaper.reap(ScalableReaper.java:30) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:621) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:70) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:662) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.deleteList(BaseOperation.java:696) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:636) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:70) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.openshift.client.dsl.internal.DeploymentConfigOperationsImpl$DeploymentConfigReaper.reap(DeploymentConfigOperationsImpl.java:129) ~[openshift-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:621) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.delete(BaseOperation.java:70) ~[kubernetes-client-3.1.4.jar!/:na]
	at io.syndesis.server.openshift.OpenShiftServiceImpl.removeDeploymentConfig(OpenShiftServiceImpl.java:279) ~[server-openshift-1.4-SNAPSHOT.jar!/:1.4-SNAPSHOT]
	at io.syndesis.server.openshift.OpenShiftServiceImpl.delete(OpenShiftServiceImpl.java:110) ~[server-openshift-1.4-SNAPSHOT.jar!/:1.4-SNAPSHOT]
	at io.syndesis.server.endpoint.v1.handler.integration.IntegrationHandler.delete(IntegrationHandler.java:237) ~[server-endpoint-1.4-SNAPSHOT.jar!/:1.4-SNAPSHOT]

According to some investigation this seems an issue related to the behaviour of the k8s client.

Related issues:

• Error 500 when deleting integrations syndesisio/syndesis#3151
• Deleting environment fails with: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on arquillian/arquillian-cube#1050