Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-6816

Permission Error due to operator updating the SCC in OpenShift Logging 6.x

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Hide
      Before this change the operator was unable to update the securitycontextconstraint that is required by the log collector which was a regression from previous releases. This provides a fix to that behavior by restoring the required cluster role to the operator's service account so that it can create or update this resource.
      Show
      Before this change the operator was unable to update the securitycontextconstraint that is required by the log collector which was a regression from previous releases. This provides a fix to that behavior by restoring the required cluster role to the operator's service account so that it can create or update this resource.
    • Bug Fix
    • Log Collection - Sprint 268
    • Moderate

      Description of problem:

          The presence of duplicate capabilities in the requiredDropCapabilities section of the securitycontextconstraints resource gives the below error in the logs of cluster-logging-operator:
      error":{"msg":"securitycontextconstraints.security.openshift.io \"logging-scc\" is forbidden: User \"system:serviceaccount:openshift-logging:cluster-logging-operator\" cannot update resource \"securitycontextconstraints\" in API group \"security.openshift.io\" at the cluster scope
      Example of the overwritten parameters in requiredDropCapabilities section of the `logging-scc`:

- CHOWN
- DAC_OVERRIDE
- FOWNER
- FSETID
- KILL
- KILL
- SETGID
- SETUID
- NET_BIND_SERVICE

       

      Version-Release number of selected component (if applicable):

      How reproducible:

      Steps to Reproduce:

        

      Actual results:

      - CHOWN 
- DAC_OVERRIDE 
- FOWNER 
- FSETID 
- KILL 
- KILL 
- SETGID 
- SETUID 
- NET_BIND_SERVICE

      Expected results:

      - CHOWN 
- DAC_OVERRIDE 
- FOWNER 
- FSETID 
- KILL 
- SETCAP 
- SETGID 
- SETUID 
- NET_BIND_SERVICE

      Additional info:

          In another case (for a fresh installation of logging 6), the value which got repeated was "NET_BIND_SERVICE".

              jcantril@redhat.com Jeffrey Cantrill
              rhn-support-khmishra Khushi Mishra
              Kabir Bharti Kabir Bharti
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: