Repository: tektoncd/operator
Pull request #702 (2022-03-21 10:34:57)

Removes security context for Hub Api deployment in case of openshift
With Hub v1.7.1 release SecurityContext of fsGroup with id 101 is added,
because the pod didn't have permissions to create a new directory,
but this SecurityContext is not supported by Openshift

Hence this patch removes the SecurityContext using a transformer as
the pod has the permissions already to create a directory

Signed-off-by: Puneet Punamiya <ppunamiy@redhat.com>

# Changes

<!-- 🎉🎉🎉 Thank you for the PR!!! 🎉🎉🎉 -->

<!-- Describe your changes here- ideally you can get that description straight from
your descriptive commit message(s)! -->

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

<!--
Describe any user facing changes here, or delete this block.

Examples of user facing changes:
- API changes
- Bug fixes
- Any changes in behavior
- Changes requiring upgrade notices or deprecation warnings

For pull requests with a release note:

```release-note
Your release note here
```

For pull requests that require additional action from users switching to the new release, include the string "action required" (case insensitive) in the release note:

```release-note
action required: your release note here
```

For pull requests that don't need to be mentioned at release time, use the `/release-note-none` Prow command to add the `release-note-none` label to the PR. You can also write the string "NONE" as a release note in your PR description:

```release-note
NONE
```
-->


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **vincent-pli**
You can assign the PR to them by writing `/assign @vincent-pli` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["vincent-pli"]} -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/transformer.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/702/pull-tekton-operator-go-coverage/1505855592114163714/artifacts/line-cov.html#file0) | 81.2% | 79.2% | -2.1

tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["vincent-pli"]} -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/transformer.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/702/pull-tekton-operator-go-coverage/1505864400903344131/artifacts/line-cov.html#file0) | 81.2% | 79.2% | -2.1


Patch:
diff --git a/Makefile b/Makefile
index bf354667d..06f88c440 100644
--- a/Makefile
+++ b/Makefile
@@ -23,10 +23,13 @@ export GO111MODULE=on
 $(BIN):
 	@mkdir -p $@
 $(BIN)/%: | $(BIN) ; $(info $(M) building $(PACKAGE)…)
-	$Q tmp=$$(mktemp -d); \
-	   env GO111MODULE=off GOPATH=$$tmp GOBIN=$(BIN) $(GO) get $(PACKAGE) \
+	$Q tmp=$$(mktemp -d); cd $$tmp; \
+  		env GO111MODULE=on GOPATH=$$tmp GOBIN=$(BIN) $(GO) install $(PACKAGE) \
 		|| ret=$$?; \
-	   rm -rf $$tmp ; exit $$ret
+  		env GO111MODULE=on GOPATH=$$tmp GOBIN=$(BIN) $(GO) clean -modcache \
+        || ret=$$?; \
+		cd - ; \
+	  	rm -rf $$tmp ; exit $$ret
 
 KO = $(or ${KO_BIN},${KO_BIN},$(BIN)/ko)
 
@@ -35,10 +38,12 @@ TEKTON_TRIGGERS_VERSION ?= latest
 TEKTON_DASHBOARD_VERSION ?= latest
 TEKTON_RESULTS_VERSION ?= v0.4.0 # latest returns an older version hence hard coding to v0.3.1 for now (tektoncd/results#138)
 PAC_VERSION ?= 0.5.4
-TEKTON_HUB_VERSION ?= v1.7.0 # latest doesn't returns any version hence hard coding to v1.7.0 for now
+TEKTON_HUB_VERSION ?= v1.7.1 # latest doesn't returns any version hence hard coding to v1.7.1 for now
 TEKTON_CHAINS_VERSION ?= latest
 
-$(BIN)/ko: PACKAGE=github.com/google/ko
+# TODO: after updating go version to 1.17 uncommnent the line below to install latest version of ko
+# $(BIN)/ko: PACKAGE=github.com/google/ko
+$(BIN)/ko: PACKAGE=github.com/google/ko@v0.9.3
 
 KUSTOMIZE = $(or ${KUSTOMIZE_BIN},${KUSTOMIZE_BIN},$(BIN)/kustomize)
 $(BIN)/kustomize: | $(BIN) ; $(info $(M) getting kustomize)
diff --git a/config/openshift/base/operator.yaml b/config/openshift/base/operator.yaml
index 8964fbc9e..9781d3688 100644
--- a/config/openshift/base/operator.yaml
+++ b/config/openshift/base/operator.yaml
@@ -67,11 +67,13 @@ spec:
         - name: IMAGE_HUB_TEKTON_HUB_DB
           value: registry.redhat.io/rhel8/postgresql-13@sha256:6032adb3eac903ee8aa61f296ca9aaa57f5709e5673504b609222e042823f195
         - name: IMAGE_ADDONS_PARAM_BUILDER_IMAGE
-          value: registry.redhat.io/rhel8/buildah@sha256:31f84b19a0774be7cfad751be38fc97f5e86cefd26e0abaec8047ddc650b00bf
+          value: registry.redhat.io/rhel8/buildah@sha256:23fb7971ea6ac4aaaaa1139473a602df0df19222a3b5a76b551b2b9ddd92e927
         - name: IMAGE_ADDONS_PARAM_KN_IMAGE
           value: registry.redhat.io/openshift-serverless-1/client-kn-rhel8@sha256:b8b992e36f76d80b1daeed0532adf94b1ce570a6aaef1dbcc2a28c666f8cd296
+        - name: IMAGE_ADDONS_MVN_SETTINGS
+          value: registry.redhat.io/ubi8/ubi-minimal@sha256:574f201d7ed185a9932c91cef5d397f5298dff9df08bc2ebb266c6d1e6284cd1
         - name: IMAGE_ADDONS_SKOPEO_COPY
-          value: registry.redhat.io/rhel8/skopeo@sha256:a458abaee565344e8c31468bb5bec26bdc622c559678ab73b07ee4998de68bd0
+          value: registry.redhat.io/rhel8/skopeo@sha256:cc58da50c3842f5f2a4ba8781b60f6052919a5555a000cb4eb18a0bd0241b2b3
         - name: IMAGE_ADDONS_GENERATE
           value: registry.redhat.io/ocp-tools-4-tech-preview/source-to-image-rhel8@sha256:98d8cb3a255641ca6a1bce854e5e2460c20de9fb9b28e3cc67eb459f122873dd
 #          - name: IMAGE_ADDONS_TKN_CLI_SERVE
diff --git a/hack/openshift/update-image-sha.sh b/hack/openshift/update-image-sha.sh
index b10289bc9..665aeb34c 100755
--- a/hack/openshift/update-image-sha.sh
+++ b/hack/openshift/update-image-sha.sh
@@ -48,6 +48,7 @@ declare -A IMAGES=(
   ["kn"]="registry.redhat.io/openshift-serverless-1/client-kn-rhel8"
   ["skopeo-copy"]="registry.redhat.io/rhel8/skopeo"
   ["s2i"]="registry.redhat.io/ocp-tools-4-tech-preview/source-to-image-rhel8"
+  ["ubi-minimal"]="registry.redhat.io/ubi8/ubi-minimal"
 )
 
 find_latest_versions() {
diff --git a/operatorhub/openshift/config.yaml b/operatorhub/openshift/config.yaml
index 2ea51349f..af3373643 100644
--- a/operatorhub/openshift/config.yaml
+++ b/operatorhub/openshift/config.yaml
@@ -56,6 +56,13 @@ image-substitutions:
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_PIPELINES_ARG__KUBECONFIG_WRITER_IMAGE
+- image: registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel8@
+  replaceLocations:
+    envTargets:
+      - deploymentName: openshift-pipelines-operator
+        containerName: openshift-pipelines-operator
+        envKeys:
+          - IMAGE_PIPELINES_ARG__WORKINGDIRINIT_IMAGE
 - image: registry.redhat.io/openshift-pipelines/pipelines-pullrequest-init-rhel8@
   replaceLocations:
     envTargets:
@@ -112,14 +119,14 @@ image-substitutions:
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_ADDONS_PARAM_KN_IMAGE
-- image: registry.redhat.io/rhel8/skopeo@sha256:a458abaee565344e8c31468bb5bec26bdc622c559678ab73b07ee4998de68bd0
+- image: registry.redhat.io/rhel8/skopeo@sha256:cc58da50c3842f5f2a4ba8781b60f6052919a5555a000cb4eb18a0bd0241b2b3
   replaceLocations:
     envTargets:
     - deploymentName: openshift-pipelines-operator
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_ADDONS_SKOPEO_COPY
-- image: registry.redhat.io/rhel8/buildah@sha256:31f84b19a0774be7cfad751be38fc97f5e86cefd26e0abaec8047ddc650b00bf
+- image: registry.redhat.io/rhel8/buildah@sha256:23fb7971ea6ac4aaaaa1139473a602df0df19222a3b5a76b551b2b9ddd92e927
   replaceLocations:
     envTargets:
     - deploymentName: openshift-pipelines-operator
@@ -133,6 +140,14 @@ image-substitutions:
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_ADDONS_GENERATE
+
+- image: registry.redhat.io/ubi8/ubi-minimal@sha256:574f201d7ed185a9932c91cef5d397f5298dff9df08bc2ebb266c6d1e6284cd1
+  replaceLocations:
+    envTargets:
+      - deploymentName: openshift-pipelines-operator
+        containerName: openshift-pipelines-operator
+        envKeys:
+          - IMAGE_ADDONS_MVN_SETTINGS
 - image: registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8@
   replaceLocations:
     envTargets:
@@ -199,13 +214,15 @@ image-substitutions:
 # add third party images which are not replaced by operator
 # but pulled directly by tasks here
 defaultRelatedImages:
-- image: registry.redhat.io/rhel8/buildah@sha256:31f84b19a0774be7cfad751be38fc97f5e86cefd26e0abaec8047ddc650b00bf
+- image: registry.redhat.io/rhel8/buildah@sha256:23fb7971ea6ac4aaaaa1139473a602df0df19222a3b5a76b551b2b9ddd92e927
   name: IMAGE_ADDONS_PARAM_BUILDER_IMAGE
 - image: registry.redhat.io/openshift-serverless-1/client-kn-rhel8@sha256:b8b992e36f76d80b1daeed0532adf94b1ce570a6aaef1dbcc2a28c666f8cd296
   name: IMAGE_ADDONS_PARAM_KN_IMAGE
-- image: registry.redhat.io/rhel8/skopeo@sha256:a458abaee565344e8c31468bb5bec26bdc622c559678ab73b07ee4998de68bd0
+- image: registry.redhat.io/rhel8/skopeo@sha256:cc58da50c3842f5f2a4ba8781b60f6052919a5555a000cb4eb18a0bd0241b2b3
   name: IMAGE_ADDONS_SKOPEO_COPY
 - image: registry.redhat.io/ocp-tools-4-tech-preview/source-to-image-rhel8@sha256:98d8cb3a255641ca6a1bce854e5e2460c20de9fb9b28e3cc67eb459f122873dd
   name: IMAGE_ADDONS_GENERATE
+- image: registry.redhat.io/ubi8/ubi-minimal@sha256:574f201d7ed185a9932c91cef5d397f5298dff9df08bc2ebb266c6d1e6284cd1
+  name: IMAGE_ADDONS_MVN_SETTINGS
 #- image: "" ##<imagename>:<tag> or <imagename>@<sha>
 #  name: "" # ENV key name value
diff --git a/pkg/reconciler/openshift/common/transformer.go b/pkg/reconciler/openshift/common/transformer.go
index c975b5a52..eca614eee 100644
--- a/pkg/reconciler/openshift/common/transformer.go
+++ b/pkg/reconciler/openshift/common/transformer.go
@@ -84,3 +84,34 @@ func RemoveRunAsGroup() mf.Transformer {
 		return nil
 	}
 }
+
+// RemoveFsGroup will remove FsGroup in a deployment
+func RemoveFsGroup(obj string) mf.Transformer {
+	return func(u *unstructured.Unstructured) error {
+		if u.GetKind() != "Deployment" {
+			return nil
+		}
+
+		d := &appsv1.Deployment{}
+		err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, d)
+		if err != nil {
+			return err
+		}
+
+		if d.Name == obj {
+			if d.Spec.Template.Spec.SecurityContext != nil {
+				d.Spec.Template.Spec.SecurityContext = nil
+			}
+
+			unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(d)
+			if err != nil {
+				return err
+			}
+			u.SetUnstructuredContent(unstrObj)
+
+			return nil
+		}
+
+		return nil
+	}
+}
diff --git a/pkg/reconciler/openshift/tektonhub/extension.go b/pkg/reconciler/openshift/tektonhub/extension.go
index 8eddeea06..9c4e157c0 100644
--- a/pkg/reconciler/openshift/tektonhub/extension.go
+++ b/pkg/reconciler/openshift/tektonhub/extension.go
@@ -31,6 +31,7 @@ import (
 	"github.com/tektoncd/operator/pkg/client/clientset/versioned"
 	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
+	openshiftCommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
 	"go.uber.org/zap"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -88,7 +89,7 @@ type openshiftExtension struct {
 }
 
 func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
-	return []mf.Transformer{UpdateDbDeployment()}
+	return []mf.Transformer{UpdateDbDeployment(), openshiftCommon.RemoveFsGroup(api)}
 }
 
 func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.TektonComponent) error {
diff --git a/pkg/reconciler/shared/tektonconfig/instance.go b/pkg/reconciler/shared/tektonconfig/instance.go
index 2d97d1b73..52e3d8ed7 100644
--- a/pkg/reconciler/shared/tektonconfig/instance.go
+++ b/pkg/reconciler/shared/tektonconfig/instance.go
@@ -84,7 +84,7 @@ func (tc tektonConfig) ensureInstance(ctx context.Context) {
 		err = tc.createInstance(ctx)
 		if err != nil {
 			//log error and retry
-			logger.Errorf("error creating Tektonconfig instance, Name: ", instance.GetName())
+			logger.Errorf("error creating Tektonconfig instance, Name: %s, Err: %v", instance.GetName(), err)
 			return false, nil
 		}
 		// even if there is no error after create,


Test patch:
diff --git a/pkg/reconciler/openshift/common/testdata/test-remove-fs-group-expected.yaml b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group-expected.yaml
new file mode 100644
index 000000000..a220b5bc5
--- /dev/null
+++ b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group-expected.yaml
@@ -0,0 +1,51 @@
+# Copyright © 2022 The Tekton Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tekton-hub-api
+  labels:
+    app: tekton-hub-api
+spec:
+  selector:
+    matchLabels:
+      app: tekton-hub-api
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: tekton-hub-api
+    spec:
+      volumes:
+      - name: catalog-source
+        persistentVolumeClaim:
+          claimName: tekton-hub-api
+      - name: ssh-creds
+        secret:
+          secretName: tekton-hub-api-ssh-crds
+          optional: true
+      securityContext:
+        fsGroup: 101
+      containers:
+        - name: tekton-hub-api
+          image: quay.io/tekton-hub/api
+          volumeMounts:
+          - name: catalog-source
+            mountPath: "/tmp/catalog"
+          - name: ssh-creds
+            mountPath: "/home/hub/.ssh"
+          ports:
+            - containerPort: 8000
+            - containerPort: 4200
diff --git a/pkg/reconciler/openshift/common/testdata/test-remove-fs-group.yaml b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group.yaml
new file mode 100644
index 000000000..480f29d19
--- /dev/null
+++ b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group.yaml
@@ -0,0 +1,49 @@
+# Copyright © 2022 The Tekton Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tekton-hub-api
+  labels:
+    app: tekton-hub-api
+spec:
+  selector:
+    matchLabels:
+      app: tekton-hub-api
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: tekton-hub-api
+    spec:
+      volumes:
+      - name: catalog-source
+        persistentVolumeClaim:
+          claimName: tekton-hub-api
+      - name: ssh-creds
+        secret:
+          secretName: tekton-hub-api-ssh-crds
+          optional: true
+      containers:
+        - name: tekton-hub-api
+          image: quay.io/tekton-hub/api
+          volumeMounts:
+          - name: catalog-source
+            mountPath: "/tmp/catalog"
+          - name: ssh-creds
+            mountPath: "/home/hub/.ssh"
+          ports:
+            - containerPort: 8000
+            - containerPort: 4200
diff --git a/pkg/reconciler/openshift/common/transformer_test.go b/pkg/reconciler/openshift/common/transformer_test.go
index 6abc4cd6d..f0c46fe28 100644
--- a/pkg/reconciler/openshift/common/transformer_test.go
+++ b/pkg/reconciler/openshift/common/transformer_test.go
@@ -118,3 +118,32 @@ func TestUpdateDeploymentsInterceptor(t *testing.T) {
 		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
 	}
 }
+
+func TestRemoveFsGroup(t *testing.T) {
+	testData := path.Join("testdata", "test-remove-fs-group.yaml")
+	manifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	testData = path.Join("testdata", "test-remove-fs-group-expected.yaml")
+	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	newManifest, err := expectedManifest.Transform(RemoveFsGroup("tekton-hub-api"))
+	assert.NilError(t, err)
+
+	got := &appsv1.Deployment{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(newManifest.Resources()[0].Object, got)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	expected := &appsv1.Deployment{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(manifest.Resources()[0].Object, expected)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	if d := cmp.Diff(expected, got); d != "" {
+		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
+	}
+}
diff --git a/test/config.sh b/test/config.sh
index 21aea2046..5bdb52ab2 100644
--- a/test/config.sh
+++ b/test/config.sh
@@ -4,3 +4,4 @@ export TEKTON_RESULTS_VERSION=v0.4.0
 export TEKTON_DASHBOARD_VERSION=latest
 export TEKTON_CHAINS_VERSION=latest
 export PAC_VERSION=0.5.2
+export TEKTON_HUB_VERSION=v1.7.1
diff --git a/test/e2e-common.sh b/test/e2e-common.sh
index 3d87c5b8d..e5d73f996 100755
--- a/test/e2e-common.sh
+++ b/test/e2e-common.sh
@@ -29,12 +29,13 @@ source $(dirname $0)/config.sh
 function install_operator_resources() {
 
   echo :Payload Targets:
-  echo Pipelines: ${PIPELINES_VERSION}
-  echo Triggers: ${TRIGGERS_VERSION}
-  echo Chains: ${CHAINS_VERSION}
+  echo Pipelines: ${TEKTON_PIPELINE_VERSION}
+  echo Triggers: ${TEKTON_TRIGGERS_VERSION}
+  echo Chains: ${TEKTON_CHAINS_VERSION}
+  echo Hub: ${TEKTON_HUB_VERSION}
   if [[ ${TARGET} != "openshift" ]]; then
-    echo Results: ${RESULTS_VERSION}
-    echo Dashboard: ${DASHBOARD_VERSION}
+    echo Results: ${TEKTON_RESULTS_VERSION}
+    echo Dashboard: ${TEKTON_DASHBOARD_VERSION}
   fi
   echo '------------------------------'
 
diff --git a/test/resources/verify.go b/test/resources/verify.go
index de87b3a93..811bfcf8a 100644
--- a/test/resources/verify.go
+++ b/test/resources/verify.go
@@ -62,7 +62,7 @@ func DeleteAndVerifyDeployments(t *testing.T, clients *utils.Clients, namespace,
 	})
 
 	if waitErr != nil {
-		t.Fatalf("The deployment %s/%s failed to reach the desired state: %v", deployment.Namespace, deployment.Name, err)
+		t.Fatalf("The deployment %s/%s failed to reach the desired state: %v", deployment.Namespace, deployment.Name, waitErr)
 	}
 }