New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
remove over privileged rbac from cnao manifest #413
remove over privileged rbac from cnao manifest #413
Conversation
e06522a
to
010ea01
Compare
/retest prow hiccup |
/retest |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems legit. Thanks.
Please add proper commit message.
Currently the cnao rbac Policy has a segment that elevates the container privileges to all resources, and all verbs. This is too much for the cnao's needs, and also in turn changes scc to anyuid in cnv/okd clusters. Hence, the rbac segment is removed in this commit. Signed-off-by: Ram Lavi <ralavi@redhat.com>
010ea01
to
19291e6
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/approve
/lgtm
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: phoracek The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This change prevents us from deploying anything on OpenShift. Reverting. |
This reverts commit 1ce8c55. We have to rework this and allow CNAO to edit more resources. By dropping of the global role, we blocked us from creating anything on OpenShift. Signed-off-by: Petr Horacek <phoracek@redhat.com>
Signed-off-by: Ram Lavi ralavi@redhat.com
What this PR does / why we need it:
Currently the cnao rbac Policy has a segment that elevates the container privileges to all resources, and all verbs.
This is too much for the cnao's needs, and also in turn changes scc to anyuid in cnv/okd clusters.
Hence, the rbac segment is removed in this commit.
Special notes for your reviewer:
Release note: