Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-36390

[aws] "create" iam role permissions required even when BYO role

XMLWordPrintable

    • Low
    • No
    • False
    • Hide

      None

      Show
      None
    • Hide
      * Previously, the installation program required permission to create and delete IAM roles when installing a cluster on {aws-short} even when an existing IAM role was provided. With this update, the installation program only requires these permissions when it is creating IAM roles. (link:https://issues.redhat.com/browse/OCPBUGS-36390[*OCPBUGS-36390*])
      Show
      * Previously, the installation program required permission to create and delete IAM roles when installing a cluster on {aws-short} even when an existing IAM role was provided. With this update, the installation program only requires these permissions when it is creating IAM roles. (link: https://issues.redhat.com/browse/OCPBUGS-36390 [* OCPBUGS-36390 *])
    • Bug Fix
    • Done

      Description of problem:

          The Installer still requires permissions to create and delete IAM roles even when the users brings existing roles.

      Version-Release number of selected component (if applicable):

          4.16+

      How reproducible:

          always

      Steps to Reproduce:

          1. Specify existing IAM role in the install-config
    2.
    3.

      Actual results:

          The following permissions are required even though they are not used:
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:PutRolePolicy",
        "iam:TagInstanceProfile"

      Expected results:

          Only actually needed permissions are required.

      Additional info:

          I think this is tech debt from when roles were not tagged. The fix will kind of revert https://github.com/openshift/installer/pull/5286

            rdossant Rafael Fonseca dos Santos
            rdossant Rafael Fonseca dos Santos
            Yunfei Jiang Yunfei Jiang
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: