Bug 1470824

Summary: Revisit privileges granted to Service Accounts used by Ansible Service Broker
Product: OpenShift Container Platform Reporter: John Matthews <jmatthew>
Component: Service BrokerAssignee: John Matthews <jmatthew>
Status: CLOSED ERRATA QA Contact: Weihua Meng <wmeng>
Severity: low Docs Contact:
Priority: unspecified    
Version: 3.6.0CC: aos-bugs, fabian, jesusr, jmatthew, wjiang
Target Milestone: ---   
Target Release: 3.7.0   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-28 22:01:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description John Matthews 2017-07-13 18:34:21 UTC
Description of problem:

The Ansible Service Broker runs the broker under a service account with 'cluster-admin' rights.

Workflow is that when running an APB:
1. Create a new project (if it doesn't exist)
2. broker will dynamically create a new service account in that project
3. apb runs as the dynamic service account
4. broker deletes the dynamic service account
5. application/services running in the project

We plan to implement a means for an admin to opt into what security privileges they want an APB to run with, that is not in scope for 3.6.0 timeframe.

We would also like to reuse a common role between template broker and ansible service broker if possible.

Comment 1 Fabian von Feilitzsch 2017-07-18 18:14:54 UTC
Minor update, apbs will run as "admin", not "cluster-admin" in 3.6

Comment 2 John Matthews 2017-08-24 16:12:43 UTC
Below PR drops the role to 'edit' for the service account running an APB.


Summary of service accounts:
 Broker runs under 'asb' service account set to 'admin' through a ClusterRoleBinding

 APBs run under a temporary service account granted 'edit' through a RoleBinding in the target namespace.

Comment 4 Weihua Meng 2017-09-28 06:32:43 UTC
blocked by bug https://bugzilla.redhat.com/show_bug.cgi?id=1496426

Comment 5 Weihua Meng 2017-09-28 08:35:38 UTC
Verified on ansible-service-broker 1.0.4

docker run --entrypoint=asbd  openshift3/ose-ansible-service-broker:v3.7 --version

- apiVersion: v1
  groupNames: null
  kind: RoleBinding
    creationTimestamp: 2017-09-28T08:19:05Z
    name: apb-26122543-7202-41e4-866d-b9ad913822b8
    namespace: wmeng2
    resourceVersion: "44186"
    selfLink: /oapi/v1/namespaces/wmeng2/rolebindings/apb-26122543-7202-41e4-866d-b9ad913822b8
    uid: b1739e0a-a425-11e7-971a-fa163eeebea6
    name: edit
  - kind: ServiceAccount
    name: apb-26122543-7202-41e4-866d-b9ad913822b8
    namespace: wmeng2
  - system:serviceaccount:wmeng2:apb-26122543-7202-41e4-866d-b9ad913822b8

Comment 8 errata-xmlrpc 2017-11-28 22:01:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.