| Summary: | system:router clusterrole cannot get namespaces | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Steven Walter <stwalter> |
| Component: | Networking | Assignee: | Ben Bennett <bbennett> |
| Networking sub component: | router | QA Contact: | zhaozhanqi <zzhao> |
| Status: | CLOSED NOTABUG | Docs Contact: | |
| Severity: | low | ||
| Priority: | low | CC: | andcosta, aos-bugs, javier.ramirez, rhowe |
| Version: | 3.3.0 | Keywords: | Reopened |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-12-10 17:26:38 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Steven Walter
2016-11-09 15:20:55 UTC
Anyone who can list the namespaces can find out all of the other project names in the system. In general we give the minimal set of privileges out, and let the admin decide whether they want to give out additional privileges to enable features. So, if you want to allow sharding by namespace you need to allow listing namespaces. But in general we don't want to make that a base router requirement. I see this being a documentation change describing how to create role for router sharding or adding a cluster role that gets bootstrapped that would be used for router sharding. 1. Document creating the role # oc create -f - <<EOF apiVersion: v1 kind: ClusterRole metadata: creationTimestamp: null name: namespace-reader rules: - apiGroups: - "" attributeRestrictions: null resources: - namespaces - namespaces/status verbs: - get - list - watch EOF # oc adm policy add-cluster-role-to-group namespace-reader system:routers 2. Or we would bootstrap the cluster role and just have the user run add role to group command. https://github.com/openshift/origin/blob/master/pkg/cmd/server/bootstrappolicy/policy.go Customer confirmed that approach provided by Ryan on comment #5 worked perfectly, but would like this new ClusterRole to be included by default: ~~~ Yes, what we would like to finally achieve in this case is that the role suggested by your colleague at this case is included by default in Open Shift and that router deployment docs (and tests) is updated to use it instead of cluster-reader. ~~~ The router is now added to cluster reader by the installer. https://github.com/openshift/openshift-ansible/blob/release-3.9/roles/openshift_hosted/tasks/router.yml#L76-L83 The docs also state that when using router sharding that the router should be added to the cluster-reader role. https://docs.openshift.com/container-platform/3.11/install_config/router/default_haproxy_router.html#using-router-shards |