-
Story
-
Resolution: Unresolved
-
Normal
-
None
-
builds-1.1
User Story
The Shared Resource CSI Driver previously had permission to read all Kubernetes secrets. In BUILD-965, this was changed so the user had to explicitly grant the CSI driver permission to read the given resource.
We need to verify the following with CI on Konflux:
- Shared resources works according to the described procedure.
- Shared resource CSI driver mounts fail if the appropriate RBAC isn't granted (we have some existing test cases for this, I think)
Definition of Done:
- CI testing verifies driver can only access the secrets it has been granted.
- Documentation updated with instructions on how to grant the driver permission to access the shared secret/configMap.
- depends on
-
BUILD-881 Deploy Shared Resources via OpenShift Builds Operator
- Release Pending
- relates to
-
BUILD-1168 Documented Process for Shared Resource CSI Driver Too Permissive
- Release Pending