-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
4.19
-
None
-
Moderate
-
None
-
False
-
Description of problem:
Testing in latest OCP env built with cluster-bot payload `build 4.19,openshift/cluster-authentication-operator#740`, `oc adm policy add-cluster-role-to-user` and `oc adm policy add-cluster-role-to-group` still check OpenShift OAuth specific group/user resource, those should be removed after configured external OIDC
Version-Release number of selected component (if applicable):
cluster-bot payload built today with: `build 4.19,openshift/cluster-authentication-operator#740`
How reproducible:
Always
Steps to Reproduce:
1. Launch a TechPreviewNoUpgrade standalone OCP cluster with above build. 2. Configure Entra ID external OIDC. 3. oc login with OIDC user Logged into "https://a065xxxx.elb.ap-southeast-1.amazonaws.com:6443" as "oidc-user-test:xiuwang@redhat.com" from an external oidc issuer. You don't have any projects. Contact your system administrator to request a project. oc auth whoami ATTRIBUTE VALUE Username oidc-user-test:xiuwang@redhat.com Groups [oidc-groups-test:xxxxxxxx oidc-groups-test:xxxxxxxx system:authenticated] Extra: authentication.kubernetes.io/credential-id [JTI=e9991805-912d-4f74-8954-ca89c5ea63c0] 4. Grant cluster-admin to OIDC user 'oidc-user-test:xiuwang@redhat.com': oc adm policy add-cluster-role-to-user cluster-admin 'oidc-user-test:xiuwang@redhat.com' --context=admin Warning: User 'oidc-user-test:xiuwang@redhat.com' not found clusterrole.rbac.authorization.k8s.io/cluster-admin added: "oidc-user-test:xiuwang@redhat.com" oc adm policy add-cluster-role-to-group self-provisioner 'oidc-groups-test:external-oidc-group' --context=admin Warning: Group 'oidc-groups-test:external-oidc-group' not found clusterrole.rbac.authorization.k8s.io/self-provisioner added: "oidc-groups-test:external-oidc-group"
Actual results:
The oc cmd still checks group and user resources, and prompt warnings.
Expected results:
The oc cmd should not check OpenShift OAuth specific group/user resource after configured external OIDC
Additional info:
- is related to
-
HOSTEDCP-1246 hypershift control plane wired with external oidc
-
- Closed
-