-
Story
-
Resolution: Obsolete
-
Major
-
None
-
None
-
False
-
None
-
False
-
OCPSTRAT-247 - Gateway API using Istio for Cluster Ingress - Tech Preview
-
-
-
0
-
0
-
Rejected
Description of problem:
In the dev preview releases of the GWAPI Ingress Operator integration, the user was required to grant cluster wide permissions to the ingress operator in order for OSSM to work, as described in https://issues.redhat.com/browse/OSSM-3508 - Ensure Cluster Ingress Operator can create cluster-wide SMCP. We decided to release without waiting for OSSM-3508 to be fixed, so no backport required. This was fixed by https://github.com/maistra/istio-operator/pull/1262, which as of 8/15/23 has not yet merged. The solution is "To create a cluster-wide SMCP, all you need from now on is the cluster-wide create servicemeshcontrolplanes privilege". We probably need to add RBAC changes to our manifests and validate that GWAPI still works without adding the cluster wide permissions.
Version-Release number of selected component (if applicable):
4.14
How reproducible:
If the proper permissions are not available, the installation will fail because the SMCP cannot be created.
Steps to Reproduce:
Install Gateway API with Ingress Networking, skipping step 1 in https://github.com/openshift/network-edge-tools/blob/main/docs/blogs/EnhancedDevPreviewGatewayAPI/GettingStarted.md#installation-via-the-ingress-operator,
Actual results:
When you get to the step to run "oc get smcp -n openshift-ingress" it will fail because the SMCP cannot be created
Expected results:
SMCP is created.
Additional info:
We need to update the instructions for verifying, after this fix.
- is caused by
-
OSSM-3508 Ensure Cluster Ingress Operator can create cluster-wide SMCP
- Closed