Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-37494

[aws] "create" iam role permissions required even when BYO role

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Low
    • No
    • None
    • None
    • Done
    • Bug Fix
    • Hide
      * Previously, the installation program incorrectly required {aws-first} permissions for creating Identity and Access Management (IAM) roles for an {product-title} cluster that already had these roles. With this release, the installation program only requests permissions for roles not yet created. (link:https://issues.redhat.com/browse/OCPBUGS-37494[*OCPBUGS-37494*])
      Show
      * Previously, the installation program incorrectly required {aws-first} permissions for creating Identity and Access Management (IAM) roles for an {product-title} cluster that already had these roles. With this release, the installation program only requests permissions for roles not yet created. (link: https://issues.redhat.com/browse/OCPBUGS-37494 [* OCPBUGS-37494 *])
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-36390. The following is the description of the original issue:
      —
      Description of problem:

          The Installer still requires permissions to create and delete IAM roles even when the users brings existing roles.

      Version-Release number of selected component (if applicable):

          4.16+

      How reproducible:

          always

      Steps to Reproduce:

          1. Specify existing IAM role in the install-config
    2.
    3.

      Actual results:

          The following permissions are required even though they are not used:
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:PutRolePolicy",
        "iam:TagInstanceProfile"

      Expected results:

          Only actually needed permissions are required.

      Additional info:

          I think this is tech debt from when roles were not tagged. The fix will kind of revert https://github.com/openshift/installer/pull/5286

              rdossant Rafael Fonseca dos Santos
              openshift-crt-jira-prow OpenShift Prow Bot
              None
              None
              Yunfei Jiang Yunfei Jiang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: