Uploaded image for project: 'OpenShift Builds'
  1. OpenShift Builds
  2. BUILD-407

Reserved Name Prefix for SharedSecret/SharedConfigMaps

    XMLWordPrintable

Details

    • Story
    • Resolution: Done
    • Normal
    • None
    • None
    • None
    • Sprint 220, Sprint 221, Sprint 222, Sprint 223, Sprint 224, Sprint 225, Sprint 226, Sprint 227, Sprint 228, Sprint 229, Sprint 230, Build + Jenkins Sprint 231, Build + Jenkins Sprint 232

    Description

      User Story

      As a user of an OpenShift Cluster i should be restricted from creating Shared Secrets and ConfigMaps with the "openshift-" prefix unless my access level is cluster-admin or above

      Acceptance Criteria

      • Non-cluster admins should NOT be able to create Shared Secrets and ConfigMaps with prefix that is "openshift-"
      • Cluster admins should be able to create Shared Secrets and ConfigMaps with the "openshift-" prefix.
      • Integration testing to verify behavior

      QE Impact

      • Behavior will need to be verified

      Docs Impact

      • Docs will need to reflect this new behavior

      PX Impact

      • None

      Notes

      • Creating namespaces with the "openshift-" prefix is already restricted. That code could be used as a precedent for this.

      Attachments

        Issue Links

          is blocked by

          Story - Created by Jira Software - do not edit or delete. Issue type for a user story. BUILD-406 Enhancement Proposal - Validating Webhook for Shared Resource CSI Driver

          • Undefined - Priority not specified.
          • Closed
          is documented by

          Task - Represents a small unit of work that is not end-user facing. RHDEVDOCS-4304 Docs: Reserved Name Prefix for SharedSecret/SharedConfigMaps

          • Normal - To be worked after urgent and high priorities are resolved. This term is chosen when the severity of an issue is relatively close to the level of effort to fix it. The existence of an easily implemented workaround can also lead to this priority level instead of a higher priority.
          • Closed
          links to

          GitHub openshift/cluster-storage-operator#335: BUILD-407: remove tech preview feature gate for shared resources

          GitHub openshift/cluster-storage-operator#343: BUILD-407: Revert "remove tech preview feature gate for shared resources"

          GitHub openshift/csi-driver-shared-resource#109: BUILD-407: Reserved name prefix for shared resources

          GitHub openshift/csi-driver-shared-resource#122: BUILD-407: reserve share names starting with openshift part one (code, unit test)

          GitHub openshift/csi-driver-shared-resource-operator#53: [WIP] BUILD-407: Authorize shared secrets and configmaps with openshift- prefix

          GitHub openshift/csi-driver-shared-resource-operator#56: [build-407] Mount shared secret and configmap list config path into shared driver node

          GitHub openshift/csi-driver-shared-resource-operator#56: [build-407] Mount shared secret and configmap list config path into shared driver node

          GitHub openshift/csi-driver-shared-resource-operator#61: OCPBUGS-3358: Revert "[build-407] Mount shared secret and configmap list config path into shared driver node"

          GitHub openshift/csi-driver-shared-resource-operator#62: [release-4.12] OCPBUGS-3359: Revert "[build-407] Mount shared secret and configmap list config path into shared driver node"

          GitHub openshift/csi-driver-shared-resource-operator#68: BUILD-407: switch reserver share config from configmap to envvar; update webhook config to monitor share creates

          GitHub openshift/csi-driver-shared-resource-operator#69: BUILD-407: remove pod wrapper types from validating webhook config

          GitHub openshift/openshift-controller-manager#250: BUILD-407: remove tech preview feature gate for build csi volumes

          GitHub openshift/openshift-controller-manager#251: BUILD-407: Revert "remove tech preview feature gate for build csi volumes"

          GitHub openshift/origin#27708: BUILD-407: stage one of two of migrating shared resource from tech preview to GA

          GitHub openshift/origin#27720: BUILD-407: perform build csi volume test on GA clusters

          Activity

            People

              gmontero@redhat.com Gabe Montero
              adkaplan@redhat.com Adam Kaplan
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: