Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-17119

Improve Error Messages for Multiple Required SCC Annotations Failures

XMLWordPrintable

    • Important
    • No
    • Rejected
    • False
    • Hide

      None

      Show
      None

      Description of problem:
      Create two custom SCCs with different permissions, for example, custom-scc-1 with 'privileged' and custom-scc-2 with 'restricted'. Deploy a pod with annotations "openshift.io/required-scc: custom-scc-1, custom-scc-2". Pod deployment failed with error "Error creating: pods "test-747555b669-" is forbidden: required scc/custom-restricted-v2-scc, custom-privileged-scc not found". The system fails to provide appropriate error messages for multiple required SCC annotations, leaving users unable to identify the cause of the failure effectively.

       

      Version-Release number of selected component (if applicable):

      4.14.0-0.nightly-2023-07-31-181848

      How reproducible:

      Always

      Steps to Reproduce:

      $ oc login -u testuser-0
      $ oc new-project scc-test
      $ oc create sa scc-test -n scc-test
      serviceaccount/scc-test created
      
      $ oc get scc restricted-v2 -o yaml --context=admin > custom-restricted-v2-scc.yaml
      $ sed -i -e 's/restricted-v2/custom-restricted-v2-scc/g' -e "s/MustRunAsRange/RunAsAny/" -e "s/priority: null/priority: 10/" custom-restricted-v2-scc.yaml
      
      $ oc create -f custom-restricted-v2-scc.yaml --context=admin
      securitycontextconstraints.security.openshift.io/custom-restricted-v2-scc created
      
      $ oc adm policy add-scc-to-user custom-restricted-v2-scc system:serviceaccount:scc-test:scc-test --context=admin
      clusterrole.rbac.authorization.k8s.io/system:openshift:scc:custom-restricted-v2-scc added: "scc-test"
      
      $ oc get scc privileged -o yaml --context=admin > custom-privileged-scc.yaml
      $ sed -i -e 's/privileged/custom-privileged-scc/g' -e "s/priority: null/priority: 5/" custom-privileged-scc.yaml
      
      $ oc create -f custom-privileged-scc.yaml --context=admin
      securitycontextconstraints.security.openshift.io/custom-privileged-scc created
      
      $ oc adm policy add-scc-to-user custom-privileged-scc system:serviceaccount:scc-test:scc-test --context=admin
      clusterrole.rbac.authorization.k8s.io/system:openshift:scc:custom-privileged-scc added: "scc-test"
      
      
      $ cat deployment.yaml 
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: test
      spec:
        selector:
          matchLabels:
            deployment: test
        template:
          metadata:
            annotations:
              openshift.io/required-scc: custom-restricted-v2-scc, custom-privileged-scc
            labels:
              deployment: test
          spec:
            containers:
            - args:
              - infinity
              command:
              - sleep
              image: fedora:latest
              name: sleeper
            securityContext:
              runAsNonRoot: true
            serviceAccountName: scc-test
      
      
      $ oc create -f deployment.yaml 
      deployment.apps/test created
      
      $ oc describe rs test-747555b669 | grep FailedCreate
        ReplicaFailure   True    FailedCreate
        Warning  FailedCreate  61s (x15 over 2m23s)  replicaset-controller  Error creating: pods "test-747555b669-" is forbidden: required scc/custom-restricted-v2-scc, custom-privileged-scc not found

      Actual results:

      Pod deployment failed with "Error creating: pods "test-747555b669-" is forbidden: required scc/custom-restricted-v2-scc, custom-privileged-scc not found"

      Expected results:

      Either it should ignore the second scc instead of "not found"  or it should show a proper error message

      Additional info:

       

            slaznick@redhat.com Stanislav Láznička
            rhn-support-dpunia Deepak Punia (Inactive)
            Deepak Punia Deepak Punia (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: