Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-13013

`cluster-reader` role cannot access "k8s.ovn.org" API Group resources

XMLWordPrintable

    • Moderate
    • No
    • ShiftStack Sprint 235, OSDOCS Sprint 236
    • 2
    • Rejected
    • False
    • Hide

      None

      Show
      None

      This is a clone of issue OCPBUGS-12854. The following is the description of the original issue:
      —
      This is a clone of issue OCPBUGS-11550. The following is the description of the original issue:
      —
      Description of problem:

      `cluster-reader` ClusterRole should have ["get", "list", "watch"] permissions for a number of privileged CRs, but lacks them for the API Group "k8s.ovn.org", which includes CRs such as EgressFirewalls, EgressIPs, etc.

      Version-Release number of selected component (if applicable):

      OCP 4.10 - 4.12 OVN

      How reproducible:

      Always

      Steps to Reproduce:

      1. Create a cluster with OVN components, e.g. EgressFirewall
2. Check permissions of ClusterRole `cluster-reader`

      Actual results:

      No permissions for OVN resources

      Expected results:

      Get, list, and watch verb permissions for OVN resources

      Additional info:

      Looks like a similar bug was opened for "network-attachment-definitions" in OCPBUGS-6959 (whose closure is being contested).

              ffernand@redhat.com Flavio Fernandes (Inactive)
              openshift-crt-jira-prow OpenShift Prow Bot
              Jean Chen Jean Chen
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: