Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-64566

Docs about UserDefinedNetwork requirement are inacurate result in failrues

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.18, 4.19, 4.20
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      Under UserDefinedNetwork docs, the instructions for creating UserDefinedNetwork via CLI perquisites specify you need to be logged in with cluster-admin or have view edit RBACs.
      https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/multiple_networks/primary-networks
      This is not accurate because creating namespace require cluster-admin permissions.
      While instantiating the UserDefinedNetwork CR require view/edit permissions, (or clsuter-admin).
      
      
      Regarding to instructions via webconsole
      https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/multiple_networks/primary-networks#nw-udn-cr-ui_about-user-defined-networks  
      prerequisites specify you need to have cluster-admin permissions.
      This is wrong because once the Namespace exists, the CR can be created by a user who has permissions for this namespace, i.e.: project admin.
      
      
      

      Version-Release number of selected component (if applicable):

          

      How reproducible:

          

      Steps to Reproduce:

          1. Login as project admin (non cluster-admin)
          2. Follow https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/multiple_networks/primary-networks#nw-udn-cr_about-user-defined-networks
          

      Actual results:

      Failure to create Namespace.

      Expected results:

      Docs should say the procedure require cluster admin for creating the Namespace.
      And for creating the UserDefinedNetwork it can be cluster admin or project admin (who has view and edit permissions).
      Webconsole instruction should mention non-admin cluster users can create UserDefinedNetwork objects.

      Additional info:

      Docs should emphasize the fact the admin require to provision the namespace for the project-admins. 
      And once the namespaces is ready, the project-admin can create the UserDefinedNetwork CR.
      
      Please note the user story for the UserDefiendNetwork CRD what to enable non-admin users create user-defined networks in namespaces they have permissions to, such as project admin. With zero/minimal intervention by the clsuter admin.
      In regard to the use case where project-admin wants to create UserDefiendNetwork, I think docs should emphasis where the cluster-admin role start and ends in the process.

              ocp-docs-bot OCP DocsBot
              omergi@redhat.com Or Mergi
              None
              None
              Zhanqi Zhao Zhanqi Zhao
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: