Uploaded image for project: 'Red Hat Workload Availability'
  1. Red Hat Workload Availability
  2. RHWA-655

SBR | Missing Permissions to Create SCC when installing via Operator Hub

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Hide
      When installing the Storage-based Remediation (SBR) Operator using the Operator Hub, permissions are missing to create the 'SecurityContextConstraints'.

      Cause: Attempting to install the SBR Operator using the Operator Lifecycle Manager (OLM), and applying a default SBDConfig, results in a broken state where the agent pods cannot start.
      Consequence: The operator controller logs repeated errors stating it cannot find the required 'SecurityContextConstraints'.
      Fix: Manually create the 'SecurityContextConstraints' before creating your first 'SBDConfig'.
      Result: The permissions are present to create the 'SecurityContextConstraints' where the agent pods can start.
      Show
      When installing the Storage-based Remediation (SBR) Operator using the Operator Hub, permissions are missing to create the 'SecurityContextConstraints'. Cause: Attempting to install the SBR Operator using the Operator Lifecycle Manager (OLM), and applying a default SBDConfig, results in a broken state where the agent pods cannot start. Consequence: The operator controller logs repeated errors stating it cannot find the required 'SecurityContextConstraints'. Fix: Manually create the 'SecurityContextConstraints' before creating your first 'SBDConfig'. Result: The permissions are present to create the 'SecurityContextConstraints' where the agent pods can start.
    • Bug Fix
    • In Progress
    • Important

      Attempting to install the SBR Operator via OLM and applying a default SBDConfig results in a broken state where Agent pods cannot start. 

      Missing Permissions to Create SCC : The operator controller logs repeated errors stating it cannot find the required SecurityContextConstraints: Failed to ensure SCC permissions... required SCC 'sbd-operator-sbd-agent-privileged' not found

       

      Upon inspecting the installed ClusterServiceVersion (storage-base-remediation.v0.1.0), the ClusterRole granted to the operator service account (sbd-operator-controller-manager) includes permissions to get, list, patch, and update SCCs, but missing the create verb.

      Since the SCC is not included as a static resource in the OLM bundle, and the operator is forbidden from creating it at runtime, the installation never converges.

              mshitrit@redhat.com Michael Shitrit
              rh-ee-malter Maxim Alter
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: