Uploaded image for project: 'Network Edge'
  1. Network Edge
  2. NE-1497

[GWAPI] Update code with OSSM RBAC fix

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Obsolete
    • Icon: Major Major
    • None
    • None
    • 0
    • 0
    • Rejected

      Description of problem:

      In the dev preview releases of the GWAPI Ingress Operator integration, the user was required to grant cluster wide permissions to the ingress operator in order for OSSM to work, as described in https://issues.redhat.com/browse/OSSM-3508 - Ensure Cluster Ingress Operator can create cluster-wide SMCP.
      
      We decided to release without waiting for OSSM-3508 to be fixed, so no backport required.
      
      This was fixed by https://github.com/maistra/istio-operator/pull/1262, which as of 8/15/23 has not yet merged.  The solution is "To create a cluster-wide SMCP, all you need from now on is the cluster-wide create servicemeshcontrolplanes privilege".
      
      We probably need to add RBAC changes to our manifests and validate that GWAPI still works without adding the cluster wide permissions.

      Version-Release number of selected component (if applicable):

      4.14

      How reproducible:

      If the proper permissions are not available, the installation will fail because the SMCP cannot be created.

      Steps to Reproduce:

      Install Gateway API with Ingress Networking, skipping step 1 in  https://github.com/openshift/network-edge-tools/blob/main/docs/blogs/EnhancedDevPreviewGatewayAPI/GettingStarted.md#installation-via-the-ingress-operator,  
      
      

      Actual results:

      When you get to the step to run "oc get smcp -n openshift-ingress" it will fail because the SMCP cannot be created 

      Expected results:

      SMCP is created.

      Additional info:

      We need to update the instructions for verifying, after this fix.

              cholman@redhat.com Candace Holman
              cholman@redhat.com Candace Holman
              Hongan Li Hongan Li
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: