-
Bug
-
Resolution: Done-Errata
-
Major
-
4.14.z
-
Important
-
No
-
Rejected
-
False
-
Description of problem:
Create two custom SCCs with different permissions, for example, custom-scc-1 with 'privileged' and custom-scc-2 with 'restricted'. Deploy a pod with annotations "openshift.io/required-scc: custom-scc-1, custom-scc-2". Pod deployment failed with error "Error creating: pods "test-747555b669-" is forbidden: required scc/custom-restricted-v2-scc, custom-privileged-scc not found". The system fails to provide appropriate error messages for multiple required SCC annotations, leaving users unable to identify the cause of the failure effectively.
Version-Release number of selected component (if applicable):
4.14.0-0.nightly-2023-07-31-181848
How reproducible:
Always
Steps to Reproduce:
$ oc login -u testuser-0 $ oc new-project scc-test $ oc create sa scc-test -n scc-test serviceaccount/scc-test created $ oc get scc restricted-v2 -o yaml --context=admin > custom-restricted-v2-scc.yaml $ sed -i -e 's/restricted-v2/custom-restricted-v2-scc/g' -e "s/MustRunAsRange/RunAsAny/" -e "s/priority: null/priority: 10/" custom-restricted-v2-scc.yaml $ oc create -f custom-restricted-v2-scc.yaml --context=admin securitycontextconstraints.security.openshift.io/custom-restricted-v2-scc created $ oc adm policy add-scc-to-user custom-restricted-v2-scc system:serviceaccount:scc-test:scc-test --context=admin clusterrole.rbac.authorization.k8s.io/system:openshift:scc:custom-restricted-v2-scc added: "scc-test" $ oc get scc privileged -o yaml --context=admin > custom-privileged-scc.yaml $ sed -i -e 's/privileged/custom-privileged-scc/g' -e "s/priority: null/priority: 5/" custom-privileged-scc.yaml $ oc create -f custom-privileged-scc.yaml --context=admin securitycontextconstraints.security.openshift.io/custom-privileged-scc created $ oc adm policy add-scc-to-user custom-privileged-scc system:serviceaccount:scc-test:scc-test --context=admin clusterrole.rbac.authorization.k8s.io/system:openshift:scc:custom-privileged-scc added: "scc-test" $ cat deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: test spec: selector: matchLabels: deployment: test template: metadata: annotations: openshift.io/required-scc: custom-restricted-v2-scc, custom-privileged-scc labels: deployment: test spec: containers: - args: - infinity command: - sleep image: fedora:latest name: sleeper securityContext: runAsNonRoot: true serviceAccountName: scc-test $ oc create -f deployment.yaml deployment.apps/test created $ oc describe rs test-747555b669 | grep FailedCreate ReplicaFailure True FailedCreate Warning FailedCreate 61s (x15 over 2m23s) replicaset-controller Error creating: pods "test-747555b669-" is forbidden: required scc/custom-restricted-v2-scc, custom-privileged-scc not found
Actual results:
Pod deployment failed with "Error creating: pods "test-747555b669-" is forbidden: required scc/custom-restricted-v2-scc, custom-privileged-scc not found"
Expected results:
Either it should ignore the second scc instead of "not found" or it should show a proper error message
Additional info:
- links to
-
RHSA-2023:5006 OpenShift Container Platform 4.14.z security update