Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1907812: Use separate RBAC objects for AWS CA bundle retrieval #118

Merged
merged 2 commits into from
Jan 13, 2021
Merged

Bug 1907812: Use separate RBAC objects for AWS CA bundle retrieval #118

merged 2 commits into from
Jan 13, 2021

Conversation

jsafrane
Copy link
Contributor

@jsafrane jsafrane commented Jan 5, 2021

When downgrading 4.7 cluster to 4.6, we must make sure that the 4.7 operator still can read AWS configuration (openshift-config-managed/kube-cloud-config ConfigMap) when CVO / OCS already downgraded the RBAC rules to 4.6 version. Otherwise the operator gets degraded.

Therefore use a separate RBAC objects, they won't be removed when downgrading to 4.6 at all.

@openshift/storage

@openshift-ci-robot openshift-ci-robot added the bugzilla/severity-urgent Referenced Bugzilla bug's severity is urgent for the branch this PR is targeting. label Jan 5, 2021
@openshift-ci-robot
Copy link
Contributor

@jsafrane: This pull request references Bugzilla bug 1907812, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.7.0) matches configured target release for branch (4.7.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1907812: Use separate RBAC objects for AWS CA bundle retrieval

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Jan 5, 2021
@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 5, 2021
@jsafrane jsafrane force-pushed the separate-rbac-for-aws-config branch from 777c8fe to 7bb4546 Compare January 5, 2021 11:43
@jsafrane
Use separate RBAC objects for AWS CA bundle retrieval
3275aeb 
When downgrading 4.7 cluster to 4.6, we must make sure that the 4.7
operator still can read AWS configuration
(openshift-config-managed/kube-cloud-config ConfigMap) when CVO / OCS
already downgraded the RBAC rules to 4.6 version. Otherwise the operator
gets degraded.

Therefore use a separate RBAC objects, they won't be removed when
downgrading to 4.6 at all.
@jsafrane jsafrane force-pushed the separate-rbac-for-aws-config branch from 7bb4546 to 3275aeb Compare January 5, 2021 14:05
@bertinatto
Copy link
Member

/retest

bertinatto
bertinatto reviewed Jan 5, 2021
View reviewed changes
assets/csidriveroperators/aws-ebs/07_clusterrole_aws_config.yaml Outdated
# Allow reading openshift-config-managed/kube-cloud-config ConfigMap
# with CA bundle.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the goal here is to allow reading a specific ConfigMap in a specific namespace, could we convert this ClusterRole into a Role and specify the namespace and the resource name? Like:

metadata:
  namespace: openshift-config-managed
(...)
  resources: 
  - configmaps
  resourceNames:
  - kube-cloud-config
  (...)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried resourceNames:, but CSO failed to watch - it watches all configmaps in the namespace. I'll try Role referring to a ServiceAccount in a different namespace.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, it seems it does something - at least AWS EBS operator is not complaining about RBACs.

@jsafrane jsafrane force-pushed the separate-rbac-for-aws-config branch from 9993d80 to 58423e2 Compare January 6, 2021 10:40
@bertinatto
Copy link
Member

/retest

2 similar comments
@bertinatto
Copy link
Member

/retest

@bertinatto
Copy link
Member

/retest

bertinatto
bertinatto reviewed Jan 12, 2021
View reviewed changes
Copy link
Member

@bertinatto bertinatto left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 12, 2021
@openshift-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, jsafrane

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [bertinatto,jsafrane]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

8 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 2be1e33 into openshift:master Jan 13, 2021
@openshift-ci-robot
Copy link
Contributor

@jsafrane: All pull requests linked via external trackers have merged:

Bugzilla bug 1907812 has been moved to the MODIFIED state.

In response to this:

Bug 1907812: Use separate RBAC objects for AWS CA bundle retrieval

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bertinatto bertinatto bertinatto left review comments

@tsmetana tsmetana Awaiting requested review from tsmetana

Assignees

@bertinatto bertinatto

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-urgent Referenced Bugzilla bug's severity is urgent for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@jsafrane @openshift-ci-robot @bertinatto @openshift-bot @openshift-merge-robot