Bug 1786475

Summary:	namespaced cr KUBEVIRT is owner of non-namespaced CRDs
Product:	Container Native Virtualization (CNV)	Reporter:	Asher Shoshan <ashoshan>
Component:	Virtualization	Assignee:	Roman Mohr <rmohr>
Status:	CLOSED ERRATA	QA Contact:	zhe peng <zpeng>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	2.2.0	CC:	cnv-qe-bugs, danken, fdeutsch, ipinto, ncredi, ocohen, sgott, stirabos, ycui
Target Milestone:	---
Target Release:	2.2.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	hco-bundle-registry-container-v2.2.0-225	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-30 16:27:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1785661

Description Asher Shoshan 2019-12-25 15:33:13 UTC

Description of problem:

HCO operator creates a cr of kind 'kubevirt' in namespace openshift-cnv.
Later on this resource is the owner of the non-namespaced CRDS :
v2vvmwares.kubevirt.io
virtualmachineinstancemigrations.kubevirt.io
virtualmachineinstancepresets.kubevirt.io
virtualmachineinstancereplicasets.kubevirt.io
virtualmachineinstances.kubevirt.io
virtualmachines.kubevirt.io

This can lead to deletion of cross-namespace resources by K8S.

See
Bug 1693905 (CVE-2019-3884) - CVE-2019-3884 atomic-openshift:
cross-namespace owner references can trigger deletions of valid children

Version-Release number of selected component (if applicable):
2.2.0

How reproducible:


Steps to Reproduce:
1. Install CNV
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Dan Kenigsberg 2019-12-29 08:46:35 UTC

I believe this could be the root cause of bug 1785661.

Comment 2 Nelly Credi 2020-01-01 14:31:28 UTC

isnt this a dup or the root cause of https://bugzilla.redhat.com/show_bug.cgi?id=1782241?

Comment 3 Asher Shoshan 2020-01-01 14:38:45 UTC

We don't know it for sure..

Comment 6 zhe peng 2020-01-20 07:29:51 UTC

verify with build:
Client Version: 4.3.0-0.nightly-2020-01-15-025207
Server Version: 4.3.0-0.nightly-2020-01-15-025207
Kubernetes Version: v1.16.2

step :
1. deploy OCP4.3+CNV2.2
2. check crds
$ oc describe crds virtualmachines.kubevirt.io
Metadata:
  Creation Timestamp:  2020-01-15T10:24:47Z
  Generation:          1
  Resource Version:    21344
  Self Link:           /apis/apiextensions.k8s.io/v1/customresourcedefinitions/virtualmachines.kubevirt.io
  UID:                 bdb6bbcf-a4b8-40b4-8c3c-a8c30e5b897f

there is no  "Owner References:" here

check all crds:
v2vvmwares.kubevirt.io
virtualmachineinstancemigrations.kubevirt.io
virtualmachineinstancepresets.kubevirt.io
virtualmachineinstancereplicasets.kubevirt.io
virtualmachineinstances.kubevirt.io

no owner references now.

move to verified.

Comment 8 errata-xmlrpc 2020-01-30 16:27:36 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:0307