Uploaded image for project: 'OpenShift Builds'
  1. OpenShift Builds
  2. BUILD-1206

Shared Resources Silently Fails to Mount Content

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Major Major
    • None
    • builds-1.2
    • shared-resources
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • PM Sync

      Description of problem:

      If the Shared Resource CSI Driver does not have permission to get/list/watch the underlying resource (Secret, ConfigMap), it silently fails to mount the content into the `csi` volume. This can lead to builds failing - ex if they are relying on a SharedSecret to provide RHEL entitlement keys

      Workaround: None

      Prerequisites (if any, like setup, operators/versions):

      Builds for OpenShift 1.2.0

      Steps to Reproduce

      1. Create a SharedSecret object for the cluster's RHEL entitlement key, and associated ClusterRole to use the SharedSecret. Do not create a Role/RoleBinding for the Shared Resourc CSI Driver's service account to access the entitlement key secret
      2. In the build's namespace, create a RoleBinding to the ClusterRole above.
      3. Mount the entitlement key to the `etc-pki-entitlement` volume in the Build, and try to install RHEL content in the build.

       

      Actual results:

      Build fails at runtime - can't enable the RHEL repository because no entitlement keys are present

      Expected results:

      Build pod fails to provision - can't mount the `csi` volume

      Reproducibility (Always/Intermittent/Only Once):

      Always if the Shared Resource CSI driver itself does not have permission to access the referenced Secret or ConfigMap

      Acceptance criteria: 

      Definition of Done:

      Build Details:

      Additional info (Such as Logs, Screenshots, etc):

              Unassigned Unassigned
              adkaplan@redhat.com Adam Kaplan
              Siamak Sadeghianfar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: