Bug 1419384

Summary: [DOC] Wrong system role usage in direct docker push section
Product: OpenShift Container Platform Reporter: Takayoshi Kimura <tkimura>
Component: DocumentationAssignee: Gaurav Nelson <gnelson>
Status: CLOSED CURRENTRELEASE QA Contact: Vikram Goyal <vigoyal>
Severity: medium Docs Contact: Vikram Goyal <vigoyal>
Priority: medium    
Version: 3.4.0CC: aos-bugs, gnelson, jokerman, mmccomas, tatanaka, tkimura
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-05-23 02:25:07 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Takayoshi Kimura 2017-02-06 02:08:52 UTC 
Document URL: https://docs.openshift.com/container-platform/3.4/install_config/registry/accessing_registry.html#access

Section Number and Name:  Installation and Configuration - Accessing the Registry - Accessing the Registry Directly

Describe the issue: 

It gives special roles to normal users like "system:registry" and "system:image-builder". They are roles for system users (in other words service accounts), the "system:registry" for service account default/registry and "system:image-builder" for service account */builder.

These "system:" roles are not supposed to bind to normal users.

Also it gives "admin" role to a user on openshift project, which is too wide and not recommended.

Suggestions for improvement: 

To allow a user to docker push to particular project, we need:

oadm policy add-role-to-user registry-editor USERNAME -n PROJECT

For example, user joe and project openshift:

oadm policy add-role-to-user registry-editor joe -n openshift

For pull only acceess we can use "registry-viewer" role, also worth to put here.

Additional information:
Comment 2 Gaurav Nelson 2018-04-26 13:49:37 UTC 
Updated the docs with suggestions in https://github.com/openshift/openshift-docs/pull/8919
Comment 3 Gaurav Nelson 2018-05-02 01:14:49 UTC 
@tkimura Can you please review the changes in https://github.com/openshift/openshift-docs/pull/8919
Comment 4 Takayoshi Kimura 2018-05-14 23:51:04 UTC 
Added review comment.
Comment 5 openshift-github-bot 2018-05-18 05:07:23 UTC 
Commit pushed to master at https://github.com/openshift/openshift-docs

https://github.com/openshift/openshift-docs/commit/dff45406708bc9248ce8b163f24fe6802b4a4dc0
Merge pull request #8919 from gaurav-nelson/bug1419384-fixes

added registry-editor and registry-viewer roles info
Comment 6 Gaurav Nelson 2018-05-23 02:25:07 UTC 
Updates are live now from OCP 3.5 onward https://docs.openshift.com/container-platform/3.5/install_config/registry/accessing_registry.html#access-user-prerequisites