Skip to content

OCPBUGS-20347: UPSTREAM: <carry>: SCC RBAC #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 2 commits into from
Closed

OCPBUGS-20347: UPSTREAM: <carry>: SCC RBAC #601

wants to merge 2 commits into from

Conversation

awgreene
Copy link
Contributor

After reducing the RBAC granted to the OLM ServiceAccount in an earlier commit, this commit introduces RBAC so pods that use the OLM ServiceAccount will qualify to use the restricted-v2 SCC.

@awgreene awgreene mentioned this pull request Oct 31, 2023
Merged
@openshift-ci openshift-ci bot requested review from grokspawn and ncdc October 31, 2023 14:10
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Oct 31, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: awgreene

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 31, 2023
@ncdc
Copy link
Contributor

ncdc commented Oct 31, 2023

I know we don't have a CI job on this (yet), but please try to start commits in downstream repos with UPSTREAM: <carry>|<drop>|PR # - it's helpful when rebasing.

@ncdc ncdc changed the title Introduce SSC RBAC Introduce SCC RBAC Oct 31, 2023
@awgreene
Copy link
Contributor Author

@ncdc I'm confused, this is a downstream only commit, could you clarify when to use carry vs drop?

@awgreene awgreene changed the title Introduce SCC RBAC OCPBUGS-20347: Introduce SCC RBAC Oct 31, 2023
@openshift-ci-robot openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 31, 2023
@openshift-ci-robot
Copy link

@awgreene: This pull request references Jira Issue OCPBUGS-20347, which is invalid:

  • expected the bug to target the "4.15.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

After reducing the RBAC granted to the OLM ServiceAccount in an earlier commit, this commit introduces RBAC so pods that use the OLM ServiceAccount will qualify to use the restricted-v2 SCC.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@ncdc
Copy link
Contributor

ncdc commented Oct 31, 2023

Sure! The terminology is a bit "weird":

  • carry: we need this downstream and it's not upstream
  • drop: use for go mod vendor commits, anything having to do with generating files (because we'll redo these each rebase), or anything we don't intend to carry forward in the next rebase

@awgreene awgreene changed the title OCPBUGS-20347: Introduce SCC RBAC OCPBUGS-20347: SCC RBAC Oct 31, 2023
@awgreene awgreene changed the title OCPBUGS-20347: SCC RBAC OCPBUGS-20347: UPSTREAM: <carry>: SCC RBAC Oct 31, 2023
@awgreene
Copy link
Contributor Author

awgreene commented Oct 31, 2023 •
edited
Loading

Thanks for the definition @ncdc! I think I've got the commit/PR in the correct state based on your guidance and this PR.

@grokspawn
Copy link
Contributor

Sure! The terminology is a bit "weird":

It helped me to think of the "me" perspective as upstream. Then these are all messages to upstream about what to do with what's downstream and the semantics make sense.

@grokspawn
Copy link
Contributor

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Nov 1, 2023
@openshift-ci-robot
Copy link

@grokspawn: This pull request references Jira Issue OCPBUGS-20347, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.15.0) matches configured target version for branch (4.15.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jianzhangbjz

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot requested a review from jianzhangbjz November 1, 2023 13:58
@jianzhangbjz
Copy link
Contributor

Test fail, details: https://issues.redhat.com/browse/OCPBUGS-20347
/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 2, 2023
jianzhangbjz
jianzhangbjz reviewed Nov 2, 2023
View reviewed changes
manifests/0000_50_olm_01-olm-operator.serviceaccount.yaml Outdated
@@ -22,6 +22,14 @@ rules:
verbs: ["*"]
Copy link
Contributor

@jianzhangbjz jianzhangbjz Nov 2, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This rule below still exists, so it still has the high access permission and can get all SCC.

- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jianzhangbjz we need this PR which contains this commit.

Copy link
Contributor Author

@awgreene awgreene Nov 2, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've pulled that commit into this PR.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it, thanks!

@awgreene
Specify exact verbs that OLM requires
8f834fe 
This will specifically allow OLM to avoid the "use" verb for SCCs that
it wasn't configured to work with on OpenShift clusters.

Signed-off-by: Alexander Greene <[email protected]>

Upstream-repository: operator-lifecycle-manager
Upstream-commit: 1c419a3fd20207ac8c6d41030e96d0c7b0275efd
@awgreene
UPSTREAM: <carry>: SSC RBAC
5f78993 
After reducing the RBAC granted to the OLM ServiceAccount in an earlier
commit, this commit introduces RBAC so pods that use the OLM
ServiceAccount will qualify to use the restricted-v2 SCC.

Signed-off-by: Alexander Greene <[email protected]>
@awgreene
Copy link
Contributor Author

awgreene commented Nov 2, 2023

@stevekuznetsov is going to pull this commit into #600, closing this.

@awgreene awgreene closed this Nov 2, 2023
@openshift-ci-robot
Copy link

@awgreene: This pull request references Jira Issue OCPBUGS-20347. The bug has been updated to no longer refer to the pull request using the external bug tracker.

In response to this:

After reducing the RBAC granted to the OLM ServiceAccount in an earlier commit, this commit introduces RBAC so pods that use the OLM ServiceAccount will qualify to use the restricted-v2 SCC.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@grokspawn grokspawn Awaiting requested review from grokspawn

@ncdc ncdc Awaiting requested review from ncdc

@jianzhangbjz jianzhangbjz Awaiting requested review from jianzhangbjz

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@awgreene @ncdc @openshift-ci-robot @grokspawn @jianzhangbjz