Incorrect service account group names

[siamaksade]

The OCP 3.9 docs incorrectly state the service account group names as:

system:serviceaccount
Includes all service accounts in the system.

system:serviceaccount:<project>
Includes all service accounts in the specified project.

On both admin and dev guides:
https://docs.openshift.com/container-platform/3.9/dev_guide/service_accounts.html
https://docs.openshift.com/container-platform/3.9/admin_guide/service_accounts.html

This is already correct in the origin docs (latest) but also needs to get applied to 3.9 since it's misleading.

[gaurav-nelson]

Thanks for submitting this issue @siamaksade

I checked the https://docs.openshift.com/container-platform/3.9/dev_guide/service_accounts.html#dev-sa-user-names-and-groups page and currently it lists the following:

system:serviceaccount
Includes all service accounts in the system.

system:serviceaccount:<project>
Includes all service accounts in the specified project.

This is different than what we have in origin (includes an 's'):

system:serviceaccounts
    Includes all service accounts in the system.
system:serviceaccounts:<project>
    Includes all service accounts in the specified project.

This change was made because of the bug https://bugzilla.redhat.com/show_bug.cgi?id=1498147

• Can you please check this again and confirm?
• Is this only applicable to the 3.9 docs?

[gaurav-nelson]

@siamaksade Can you please check this and confirm. I am afraid I have to close this if I do not get any response till 20th May 2018.

[siamaksade]

Origin docs are correct as it should be system:serviceaccounts:<project (with s). You can cross-check with Kubernetes docs: https://kubernetes.io/docs/admin/authentication/

[gaurav-nelson]

Thanks @siamaksade for your response. As I said in my previous comments, the changes were made because of https://bugzilla.redhat.com/show_bug.cgi?id=1498147. It was with an (s) before that change. I also checked the commands in OCP 3.9 and it works for both of them:

[admin@ocp ~]# oc get serviceaccount
NAME       SECRETS   AGE
builder    2         14s
default    2         14s
deployer   2         14s

[admin@ocp ~]# oc get serviceaccounts
NAME       SECRETS   AGE
builder    2         17s
default    2         17s
deployer   2         17s

[admin@ocp ~]# oc get serviceaccounts default -o yaml
apiVersion: v1
imagePullSecrets:
- name: default-dsfew-32fewfs
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-05-17T01:38:56Z
  name: default
  namespace: myproject
  resourceVersion: "1100"
  selfLink: /api/v1/namespaces/myproject/serviceaccounts/default
  uid: 104d251f-2342-11e8-sd32-54ee750d361f
secrets:
- name: default-token-sxv32
- name: default-dsfew-5clwt

[admin@ocp ~]# oc get serviceaccount default -o yaml
apiVersion: v1
imagePullSecrets:
- name: default-dsfew-32fewfs
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-05-17T01:38:56Z
  name: default
  namespace: myproject
  resourceVersion: "1100"
  selfLink: /api/v1/namespaces/myproject/serviceaccounts/default
  uid: 104d251f-2342-11e8-sd32-54ee750d361f
secrets:
- name: default-token-sxv32
- name: default-dsfew-5clwt

[admin@ocp ~]# oc policy add-role-to-user view system:serviceaccount:test1:default
role "view" added: "system:serviceaccount:test1:default"

[admin@ocp ~]# oc policy add-role-to-user edit system:serviceaccounts:test1:default
role "edit" added: "system:serviceaccounts:test1:default"

I am closing this one, as the documentation list correct commands and they are working.

[gaurav-nelson]

Please feel free to reopen this, if you think I misinterpreted something. Thanks again for submitting this.

[siamaksade]

oc get command is not sensitive to the singular and plural form of object types (pod/pods, route/routes, etc) and is not the right test for this scenario.

Try this instead:

oc new-project test
oc get rolebinding

You would see the default generated role bindings. Notice the last one which is system:serviceaccounts:test which refers to all service accounts in the specified project:

NAME                    ROLE                    USERS       GROUPS                        SERVICE ACCOUNTS   SUBJECTS
admin                   /admin                  developer
system:deployers        /system:deployer                                                  deployer
system:image-builders   /system:image-builder                                             builder
system:image-pullers    /system:image-puller                system:serviceaccounts:test

[gaurav-nelson]

Thanks @siamaksade , I checked those commands and it does report system:serviceaccounts:test1. I tried following as well and and got system:serviceaccount:test1

I also ran this (on OCP):

[root@node ~]# oc get secrets
NAME                       TYPE                                  DATA      AGE
builder-dockercfg-v6k5r    kubernetes.io/dockercfg               1         3m
builder-token-s8sx8        kubernetes.io/service-account-token   4         3m
builder-token-xcr9w        kubernetes.io/service-account-token   4         3m
default-dockercfg-mfrzq    kubernetes.io/dockercfg               1         3m
default-token-4c6bk        kubernetes.io/service-account-token   4         3m
default-token-pqg72        kubernetes.io/service-account-token   4         3m
deployer-dockercfg-hjtxz   kubernetes.io/dockercfg               1         3m
deployer-token-c4whq       kubernetes.io/service-account-token   4         3m
deployer-token-s7g7f       kubernetes.io/service-account-token   4         3m

[admin@ocp ~]# oc describe secret default-token-pqg72
Name:         default-token-pqg72
Namespace:    test1
Labels:       <none>
Annotations:  kubernetes.io/created-by=openshift.io/create-dockercfg-secrets
              kubernetes.io/service-account.name=default
              kubernetes.io/service-account.uid=3c5b9364-5a2a-11e8-b2a5-54ee750d361f

Type:  kubernetes.io/service-account-token

Data
====
service-ca.crt:  2186 bytes
token:           eyJhbGciOiJSUzI1NiIsInR5...
ca.crt:          1070 bytes
namespace:       5 bytes

[admin@ocp ~]# oc login --token=eyJhbGciOiJSUzI1NiIsInR5...
Logged into "https://127.0.0.1:8443" as "system:serviceaccount:test1:default" using the token provided.
You don't have any projects. Contact your system administrator to request a project.

[admin@ocp ~]# oc whoami
system:serviceaccount:test1:default

I think both of them are getting used inconsistently though.

[siamaksade]

Could you check with engineering? I don’t know how else to explain this. system:serviceaccount:<project>:default is correct and refers to a *single* serviceaccount with the name “default”. That’s what your commands are showing. system:serviceaccount:<project> is incorrect for referring to *all* service accounts in the project. The correct form is system:serviceaccounts:<project>

…

On Fri, 18 May 2018 at 01:43, Gaurav Nelson ***@***.***> wrote: Thanks @siamaksade <https://github.com/siamaksade> , I checked those commands and it does report system:serviceaccounts:test1. I tried following as well and and got system:serviceaccount:test1 I also ran this (on OCP): ***@***.*** ~]# oc get secrets NAME TYPE DATA AGE builder-dockercfg-v6k5r kubernetes.io/dockercfg 1 3m builder-token-s8sx8 kubernetes.io/service-account-token 4 3m builder-token-xcr9w kubernetes.io/service-account-token 4 3m default-dockercfg-mfrzq kubernetes.io/dockercfg 1 3m default-token-4c6bk kubernetes.io/service-account-token 4 3m default-token-pqg72 kubernetes.io/service-account-token 4 3m deployer-dockercfg-hjtxz kubernetes.io/dockercfg 1 3m deployer-token-c4whq kubernetes.io/service-account-token 4 3m deployer-token-s7g7f kubernetes.io/service-account-token 4 3m ***@***.*** ~]# oc describe secret default-token-pqg72 Name: default-token-pqg72 Namespace: test1 Labels: <none> Annotations: kubernetes.io/created-by=openshift.io/create-dockercfg-secrets kubernetes.io/service-account.name=default kubernetes.io/service-account.uid=3c5b9364-5a2a-11e8-b2a5-54ee750d361f Type: kubernetes.io/service-account-token Data ==== service-ca.crt: 2186 bytes token: eyJhbGciOiJSUzI1NiIsInR5... ca.crt: 1070 bytes namespace: 5 bytes ***@***.*** ~]# oc login --token=eyJhbGciOiJSUzI1NiIsInR5... Logged into "https://127.0.0.1:8443" as "system:serviceaccount:test1:default" using the token provided. You don't have any projects. Contact your system administrator to request a project. ***@***.*** ~]# oc whoami system:serviceaccount:test1:default I think both of them are getting used inconsistently though. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#8769 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABHtlkYcAYM4liK5l7QO_IT9obYA9TH4ks5tzgsbgaJpZM4TX78V> .

[siamaksade]

I am baffled that this is still not fixed! The docs is still wrong in 3.11:
https://docs.openshift.com/container-platform/3.11/admin_guide/service_accounts.html