Details
-
Bug
-
Resolution: Won't Do
-
Normal
-
None
-
4.12.z, 4.11.z, 4.10.z
-
None
-
Moderate
-
No
-
SDN Sprint 237, SDN Sprint 238
-
2
-
False
-
Description
This is a clone of issue OCPBUGS-13661. The following is the description of the original issue:
—
This is a clone of issue OCPBUGS-13013. The following is the description of the original issue:
—
This is a clone of issue OCPBUGS-12854. The following is the description of the original issue:
—
This is a clone of issue OCPBUGS-11550. The following is the description of the original issue:
—
Description of problem:
`cluster-reader` ClusterRole should have ["get", "list", "watch"] permissions for a number of privileged CRs, but lacks them for the API Group "k8s.ovn.org", which includes CRs such as EgressFirewalls, EgressIPs, etc.
Version-Release number of selected component (if applicable):
OCP 4.10 - 4.12 OVN
How reproducible:
Always
Steps to Reproduce:
1. Create a cluster with OVN components, e.g. EgressFirewall 2. Check permissions of ClusterRole `cluster-reader`
Actual results:
No permissions for OVN resources
Expected results:
Get, list, and watch verb permissions for OVN resources
Additional info:
Looks like a similar bug was opened for "network-attachment-definitions" in OCPBUGS-6959 (whose closure is being contested).
Attachments
Issue Links
- clones
-
-
- Closed
-
- is blocked by
-
-
- Closed
-
