Uploaded image for project: 'OpenShift Over the Air'
  1. OpenShift Over the Air
  2. OTA-1305

Restrict OSUS with namespaced permissions

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • None
    • None
    • None
    • 3
    • False
    • None
    • False
    • OTA 256, OTA 257

      Following up https://github.com/openshift/cincinnati-operator/pull/190#discussion_r1663190423
      "All namespaces on the cluster" installs are no longer supported,
      OSUS should work with namespaced permissions and thus the cluster level role/robindings should not be needed.

      However, the attempt of migrating to role/rolebinding from clusterrole/clusterrolebinding failed
      as the e2e job errored out

      updateservices.updateservice.operator.openshift.io is forbidden: User "system:serviceaccount:openshift-updateservice:updateservice-operator" cannot list resource "updateservices" in API group "updateservice.operator.openshift.io" at the cluster scope

      We should remove the API calls from OSUS that caused the error.

      AC:
      OSUS runs without any cluster-level permissions.

          1.
          		 QE tracker Sub-task Closed Undefined Jian Li

              hongkliu Hongkai Liu
              hongkliu Hongkai Liu
              Jian Li Jian Li
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: