Bug 1703789

Summary:	[free-stg] Rolebinding should be restricted for the common user
Product:	OpenShift Online	Reporter:	tzhou
Component:	Website	Assignee:	Justin Pierce <jupierce>
Status:	VERIFIED ---	QA Contact:	Justin Pierce <jupierce>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.x	CC:	aos-bugs, jupierce, yasun
Target Milestone:	---	Keywords:	OnlineStarter, Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-29 19:21:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description tzhou 2019-04-28 10:33:51 UTC

Description of problem: 
The role binding is restricted, should not added to other group by default.

Version-Release number of selected component (if applicable):
Kubernetes Master Version    v1.13.4+81fc896

How reproducible:
always

Steps to Reproduce:
1.Log in to the https://console-openshift-console.apps.stg-2.online-starter.openshift.com
2.Add a view role to another group,e.g: $ oc policy add-role-to-group view groupA

Actual results:
Role added successfully

Expected results:
The role "view" could not be granted.
Reason: rolebindings "view" is forbidden: rolebindings to Group "groupA" are not allowed in project "xxx"

Additional info:
Same issue not only on Group, also found on ServiceAccount and User

Comment 2 Justin Pierce 2019-04-29 21:28:32 UTC

After looking at 1684344 for a bit, we determined we could workaround this issue in online environments using a validating webhook. It has been installed in stg-2 and added to source control for subsequent clusters. Please take another look. At present, the following error should result:

$ oc policy add-role-to-group view groupA
Error from server: admission webhook "validate.rolebinding.update" denied the request: Prohibited rolebinding

Comment 3 tzhou 2019-05-05 10:03:46 UTC

Thanks Justin, Yes, At present, the following error result:

$ oc policy add-role-to-group view groupA
Error from server: admission webhook "validate.rolebinding.update" denied the request: Prohibited rolebinding

ServiceAccount and User are the same.