Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-34373

regular user should have same permission to update route tls.externalCertificate and tls.certificate

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • No
    • None
    • Rejected
    • CFE Sprint 255, CFE Sprint 256, CFE Sprint 257, NE Sprint 258, CFE Sprint 258, NE Sprint 259, NE Sprint 260, NE Sprint 261, NE Sprint 262
    • 9
    • Done
    • Bug Fix
    • Hide
      * Previously, after a user created a route, the user needed both `create` and `update` permissions on the `routes/custom-host` sub-resource to edit the `.spec.tls.externalCertificate` field of a route. With this release, this permission requirement has been fixed, so that a user only needs the `create` permission to edit the `.spec.tls.externalCertificate` field of a route. The `update` permission is now marked as an optional permission. (link:https://issues.redhat.com/browse/OCPBUGS-34373[*OCPBUGS-34373*])
      Show
      * Previously, after a user created a route, the user needed both `create` and `update` permissions on the `routes/custom-host` sub-resource to edit the `.spec.tls.externalCertificate` field of a route. With this release, this permission requirement has been fixed, so that a user only needs the `create` permission to edit the `.spec.tls.externalCertificate` field of a route. The `update` permission is now marked as an optional permission. (link: https://issues.redhat.com/browse/OCPBUGS-34373 [* OCPBUGS-34373 *])
    • None
    • None
    • None
    • None

      Description of problem:

          regular user can update route spec.tls.certificate/key without extra permissions, but if the user try to edit/patch spec.tls.externalCertificate, it reports error:
spec.tls.externalCertificate: Forbidden: user does not have update permission on custom-host

      Version-Release number of selected component (if applicable):

      4.16.0-0.nightly-2024-05-21-221942    

      How reproducible:

          100%

      Steps to Reproduce:

          1. login as regular use and create namespace, pod, svc and edge route
$ oc create route edge myedge --service service-unsecure --cert tls.crt --key tls.key
$ oc get route myedge -oyaml

    2. edit the route and remove one certificate from spec.tls.certificate 
$ oc edit route myedge
$ oc get route myedge

    3. edit the route and restore the original spec.tls.certificate

    4. edit the route with spec.tls.externalCertificate
    

      Actual results:

          1. edge route is admitted and works well
$ oc get route myedge -oyaml
<......>
spec:
  host: myedge-test3.apps.hongli-techprev.qe.azure.devcluster.openshift.com
  port:
    targetPort: http
  tls:
    certificate: |
      -----BEGIN CERTIFICATE-----
      XXXXXXXXXXXXXXXXXXXXXXXXXXX
      -----END CERTIFICATE-----
      -----BEGIN CERTIFICATE-----
      XXXXXXXXXXXXXXXXXXXXXXXX 
      -----END CERTIFICATE-----

   key: |
      -----BEGIN RSA PRIVATE KEY-----
<......>

    2. route is failed validation since "private key does not match public key"
$ oc get route myedge
NAME     HOST/PORT                  PATH   SERVICES           PORT   TERMINATION   WILDCARD
myedge   ExtendedValidationFailed          service-unsecure   http   edge          None

    3. route is admitted again after the spec.tls.certificate is restored

    4. reports error when updating spec.tls.externalCertificate 
spec.tls.externalCertificate: Forbidden: user does not have update permission on custom-host

      Expected results:

          user can has same permission to update both spec.tls.certificate and spec.tls.externalCertificate

      Additional info:

              rh-ee-ckyal Chirag Kyal
              rhn-support-hongli Hongan Li
              None
              None
              Hongan Li Hongan Li
              Darragh Fitzmaurice Darragh Fitzmaurice
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: