Bug 1819276: use rbac vs direct scc edit for s2i root bld test #24804

gabemontero · 2020-03-31T13:43:38Z

Update to our old s2i root build via privileged SCC test

Stemming from ask from @bparees in https://coreos.slack.com/archives/CB48XQ4KZ/p1585580675154600

Using recommendation from @smarterclayton and docs at https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html#role-based-access-to-ssc_configuring-internal-oauth as a reference

/assign @bparees

@bparees - the slack thread mentions 4.3

so we will want to backport this, correct?
if so, is there a tracking BZ for this already?

gabemontero · 2020-03-31T13:52:31Z

sorry forgot - @openshift/openshift-team-developer-experience FYI ... see description for details

bparees · 2020-03-31T14:06:20Z

/lgtm

@gabemontero no BZ yet. as for backporting, yeah it'd be nice to have it back to 4.3. No further than that is necessary imho.

gabemontero · 2020-03-31T15:28:01Z

My role binding construction was not quite right @bparees ... will need to update:

fail [github.com/openshift/origin/test/extended/builds/s2i_root.go:106]: Unexpected error:
    <*errors.StatusError | 0xc002ade460>: {
        ErrStatus: {
            TypeMeta: {Kind: "", APIVersion: ""},
            ListMeta: {
                SelfLink: "",
                ResourceVersion: "",
                Continue: "",
                RemainingItemCount: nil,
            },
            Status: "Failure",
            Message: "RoleBinding.rbac.authorization.k8s.io \"privileged-builder-rolebinding\" is invalid: roleRef.kind: Unsupported value: \"\": supported values: \"Role\", \"ClusterRole\"",
            Reason: "Invalid",
            Details: {
                Name: "privileged-builder-rolebinding",
                Group: "rbac.authorization.k8s.io",
                Kind: "RoleBinding",
                UID: "",
                Causes: [
                    {
                        Type: "FieldValueNotSupported",
                        Message: "Unsupported value: \"\": supported values: \"Role\", \"ClusterRole\"",
                        Field: "roleRef.kind",
                    },
                ],
                RetryAfterSeconds: 0,
            },
            Code: 422,
        },
    }
    RoleBinding.rbac.authorization.k8s.io "privileged-builder-rolebinding" is invalid: roleRef.kind: Unsupported value: "": supported values: "Role", "ClusterRole"

openshift-ci-robot · 2020-03-31T15:29:06Z

@gabemontero: This pull request references Bugzilla bug 1819276, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1819276: use rbac vs direct scc edit for s2i root bld test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

bparees · 2020-03-31T15:41:00Z

/lgtm

openshift-bot · 2020-03-31T17:12:20Z

/retest

Please review the full test history for this PR and help us cut down flakes.

gabemontero · 2020-03-31T17:12:30Z

Well, if I could get a cluster up today, I'd actually try this out locally before testing in the PR:

fail [github.com/openshift/origin/test/extended/builds/s2i_root.go:110]: Unexpected error:
    <*errors.StatusError | 0xc001bfdcc0>: {
        ErrStatus: {
            TypeMeta: {Kind: "", APIVersion: ""},
            ListMeta: {
                SelfLink: "",
                ResourceVersion: "",
                Continue: "",
                RemainingItemCount: nil,
            },
            Status: "Failure",
            Message: "RoleBinding.rbac.authorization.k8s.io \"privileged-builder-rolebinding\" is invalid: [roleRef.apiGroup: Unsupported value: \"rbac.authorization.k8s.io/v1\": supported values: \"rbac.authorization.k8s.io\", subjects[0].apiGroup: Unsupported value: \"v1\": supported values: \"\"]",
            Reason: "Invalid",
            Details: {
                Name: "privileged-builder-rolebinding",
                Group: "rbac.authorization.k8s.io",
                Kind: "RoleBinding",
                UID: "",
                Causes: [
                    {
                        Type: "FieldValueNotSupported",
                        Message: "Unsupported value: \"rbac.authorization.k8s.io/v1\": supported values: \"rbac.authorization.k8s.io\"",
                        Field: "roleRef.apiGroup",
                    },
                    {
                        Type: "FieldValueNotSupported",
                        Message: "Unsupported value: \"v1\": supported values: \"\"",
                        Field: "subjects[0].apiGroup",
                    },
                ],
                RetryAfterSeconds: 0,
            },
            Code: 422,
        },
    }
    RoleBinding.rbac.authorization.k8s.io "privileged-builder-rolebinding" is invalid: [roleRef.apiGroup: Unsupported value: "rbac.authorization.k8s.io/v1": supported values: "rbac.authorization.k8s.io", subjects[0].apiGroup: Unsupported value: "v1": supported values: ""]

another update coming @bparees ... apologies

/hold

gabemontero · 2020-03-31T17:22:27Z

I'll unhold when either a) the test passes here, or b) I get a cluster up and can try it out locally

gabemontero · 2020-03-31T19:52:18Z

ok updated test is passing now @bparees ... just dealing with non-related problems in the other e2es

/hold cancel

gabemontero · 2020-03-31T19:52:49Z

/cherrypick release-4.4

openshift-cherrypick-robot · 2020-03-31T19:52:50Z

@gabemontero: once the present PR merges, I will cherry-pick it on top of release-4.4 in a new PR and assign it to you.

In response to this:

/cherrypick release-4.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

gabemontero · 2020-03-31T19:53:00Z

/cherrypick release-4.3

openshift-cherrypick-robot · 2020-03-31T19:53:01Z

@gabemontero: once the present PR merges, I will cherry-pick it on top of release-4.3 in a new PR and assign it to you.

In response to this:

/cherrypick release-4.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

bparees · 2020-03-31T20:11:13Z

/lgtm

openshift-bot · 2020-04-01T10:22:22Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-01T13:24:23Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-01T13:50:21Z

/retest

Please review the full test history for this PR and help us cut down flakes.

gabemontero · 2020-04-01T14:57:02Z

trying upgrade again after openshift/cluster-svcat-controller-manager-operator#73 merged (saw elements of that in last upgrade failure) and subsequent CI updates noted in https://coreos.slack.com/archives/CEKNRGF25/p1585746383178000

/test e2e-gcp-upgrade

openshift-bot · 2020-04-01T15:47:25Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-01T17:53:03Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-01T18:00:07Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-01T23:09:33Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-01T23:22:01Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:06:38Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:06:47Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:07:21Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:07:26Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:07:35Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:07:42Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:07:44Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:07:54Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:08:29Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T07:26:28Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T08:57:30Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T13:17:07Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T13:29:04Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-04-02T13:42:39Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2020-04-02T15:29:52Z

@gabemontero: All pull requests linked via external trackers have merged: openshift/origin#24804. Bugzilla bug 1819276 has been moved to the MODIFIED state.

In response to this:

Bug 1819276: use rbac vs direct scc edit for s2i root bld test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2020-04-02T15:30:27Z

@gabemontero: new pull request created: #24821

In response to this:

/cherrypick release-4.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2020-04-02T15:31:12Z

@gabemontero: new pull request created: #24822

In response to this:

/cherrypick release-4.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot assigned bparees Mar 31, 2020

openshift-ci-robot requested review from coreydaley and dmage March 31, 2020 13:47

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 31, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2020

gabemontero changed the title ~~use rbac vs direct scc edit for s2i root bld test~~ Bug 1819276: use rbac vs direct scc edit for s2i root bld test Mar 31, 2020

openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Mar 31, 2020

gabemontero force-pushed the test-s2i-root-via-rbac-scc branch from a0b0202 to 045b698 Compare March 31, 2020 15:36

openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2020

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 31, 2020

use rbac vs direct scc edit for s2i root bld test

ae374fe

gabemontero force-pushed the test-s2i-root-via-rbac-scc branch from 045b698 to ae374fe Compare March 31, 2020 17:21

openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2020

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 31, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2020

openshift-merge-robot merged commit 6c02d1e into openshift:master Apr 2, 2020

This was referenced Apr 2, 2020

[release-4.3] Bug 1820266: use rbac vs direct scc edit for s2i root bld test #24821

Merged

Bug 1820265: use rbac vs direct scc edit for s2i root bld test #24822

Merged

gabemontero deleted the test-s2i-root-via-rbac-scc branch April 2, 2020 15:47

Bug 1819276: use rbac vs direct scc edit for s2i root bld test #24804

Bug 1819276: use rbac vs direct scc edit for s2i root bld test #24804

Conversation

gabemontero commented Mar 31, 2020

gabemontero commented Mar 31, 2020

bparees commented Mar 31, 2020

gabemontero commented Mar 31, 2020

openshift-ci-robot commented Mar 31, 2020

bparees commented Mar 31, 2020

openshift-bot commented Mar 31, 2020

gabemontero commented Mar 31, 2020

gabemontero commented Mar 31, 2020

gabemontero commented Mar 31, 2020

gabemontero commented Mar 31, 2020

openshift-cherrypick-robot commented Mar 31, 2020

gabemontero commented Mar 31, 2020

openshift-cherrypick-robot commented Mar 31, 2020

bparees commented Mar 31, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

gabemontero commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 1, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-bot commented Apr 2, 2020

openshift-ci-robot commented Apr 2, 2020

openshift-cherrypick-robot commented Apr 2, 2020

openshift-cherrypick-robot commented Apr 2, 2020