Solved: knative function deployed via ArgoCD errors out on next sync: admission webhook "validation.webhook.serving.knative.dev" denied the request

[kastl-ars]

Hi all,

our cluster is being managed by ArgoCD. I could successfully deploy the contents of the knative tutorial via ArgoCD, i.e. I have a hello-Function and one for the cloudevents player.

Both functions are working, I can send events and receive them in the CloudEvents player.

But now ArgoCD is throwing errors on next sync, although the resources have not changed in git. I assume that the YAML inside the cluster contains more fields than the YAML in the tutorial, hence ArgoCD thinks it needs to do something.

The error message is:

admission webhook "validation.webhook.serving.knative.dev" denied the request: validation failed: volume with name "kne-bundle-volume" not mounted: spec.template.spec.volumes[0].name

So, for the next poor soul stumbling upon this, the solution is to use the (almost) complete YAML from inside the cluster and put this into the git repository. This contains the volume mount and is thus not being rejected by the admission webhook.

---
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: cloudevents-player
  namespace: <namespace>
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/min-scale: '1'
    spec:
      containerConcurrency: 0
      containers:
        - env:
            - name: K_SINK
              value: >-
                http://broker-ingress.knative-eventing.svc.cluster.local/knative-functions/example-broker
            - name: K_CE_OVERRIDES
          image: 'quay.io/ruben/cloudevents-player:latest'
          name: user-container
          ports:
            - containerPort: 8080
              protocol: TCP
          readinessProbe:
            successThreshold: 1
            tcpSocket:
              port: 0
          resources: {}
          volumeMounts:
            - mountPath: /knative-custom-certs
              name: kne-bundle-volume
              readOnly: true
      enableServiceLinks: false
      timeoutSeconds: 300
      volumes:
        - name: kne-bundle-volume
          projected:
            sources:
              - configMap:
                  name: config-openshift-trusted-cabundle
  traffic:
    - latestRevision: true
      percent: 100

This might be a good addition to the docs, but might not fit the getting-started tutorial (as this does not use ArgoCD).

Kind Regards
Johannes