-
Bug
-
Resolution: Not a Bug
-
Major
-
None
-
builds-1.2
-
None
-
False
-
-
False
-
-
-
PM Sync
Description of problem:
If the Shared Resource CSI Driver does not have permission to get/list/watch the underlying resource (Secret, ConfigMap), it silently fails to mount the content into the `csi` volume. This can lead to builds failing - ex if they are relying on a SharedSecret to provide RHEL entitlement keys
Workaround: None
Prerequisites (if any, like setup, operators/versions):
Builds for OpenShift 1.2.0
Steps to Reproduce
- Create a SharedSecret object for the cluster's RHEL entitlement key, and associated ClusterRole to use the SharedSecret. Do not create a Role/RoleBinding for the Shared Resourc CSI Driver's service account to access the entitlement key secret
- In the build's namespace, create a RoleBinding to the ClusterRole above.
- Mount the entitlement key to the `etc-pki-entitlement` volume in the Build, and try to install RHEL content in the build.
Actual results:
Build fails at runtime - can't enable the RHEL repository because no entitlement keys are present
Expected results:
Build pod fails to provision - can't mount the `csi` volume
Reproducibility (Always/Intermittent/Only Once):
Always if the Shared Resource CSI driver itself does not have permission to access the referenced Secret or ConfigMap
Acceptance criteria:
Definition of Done:
Build Details:
Additional info (Such as Logs, Screenshots, etc):
- relates to
-
BUILD-1226 Simplify RBAC for Shared Resources
-
- New
-