Bug 1805488
| Summary: | Some core components are in openshift.io/run-level 1 and are bypassing SCC, but should not be | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Clayton Coleman <ccoleman> | |
| Component: | Security | Assignee: | Stefan Schimanski <sttts> | |
| Status: | CLOSED EOL | QA Contact: | xiyuan | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 4.4 | CC: | aos-bugs, eparis, fcanogab, jialiu, markmc, mfojtik, nstielau, scuppett, sfowler, sponnaga, sttts, vlaad, wsun, xtian, xxia, ykashtan | |
| Target Milestone: | --- | Keywords: | Reopened, Tracking | |
| Target Release: | 4.7.z | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1805570 1806438 1806892 1806893 1806902 1806903 1806904 1806905 1806906 1806907 1806908 1806909 1806913 1806915 1806917 1806918 1806919 1966621 (view as bug list) | Environment: | ||
| Last Closed: | 2022-08-30 17:18:52 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1805572, 1805917, 1806438, 1806439, 1806892, 1806893, 1806902, 1806903, 1806904, 1806905, 1806906, 1806907, 1806908, 1806909, 1806913, 1806915, 1806917, 1806918, 1806919, 1807490, 1807659, 1807762, 1830496, 1830497 | |||
| Bug Blocks: | 1966621 | |||
|
Description
Clayton Coleman
2020-02-20 21:27:33 UTC
Insights and support handled in https://github.com/openshift/insights-operator/pull/78 Components that may already have child pods in the namespace should grant the "anyuid" SCC to all pods in their namespace (group "system:serviceaccount:NAMESPACE") if there is a chance user workloads or arbitrary pods have already landed. *** This bug has been marked as a duplicate of bug 1807436 *** We made quite a bit of progress on the topic. But there are core components like service-ca and openshift-apiserver which need serious changes in the architecture to fix. Hence, we move this umbrella BZ to 4.5 for follow-up work. This isn't a showstopper for 4.5.0 GA at this point. Setting target release to 4.6.0 (the current development branch). For fixes (if any) requested/required on prior versions, clones will be created targeting those z-stream releases as appropriate. Infra namespaces fix: - openshift-openstack-infra - openshift-kni-infra - openshift-ovirt-infra - openshift-vsphere-infra https://bugzilla.redhat.com/show_bug.cgi?id=1973525 https://github.com/openshift/machine-config-operator/pull/2627/files - openshift-vertical-pod-autoscaler https://bugzilla.redhat.com/show_bug.cgi?id=1974567 - openshift-kubevirt-infra https://bugzilla.redhat.com/show_bug.cgi?id=1977129 - MCO https://bugzilla.redhat.com/show_bug.cgi?id=1978581 - CVO there is this comment here: https://github.com/openshift/cluster-version-operator/pull/24 saying that it is required, but that was 2018, not sure if it still is. @sponnaga CVO - https://github.com/openshift/cluster-version-operator/pull/623 - https://bugzilla.redhat.com/show_bug.cgi?id=2020107 I think we've fully removed `run-level: 1` from openshift now and we can close this one :-) 4.7 is EOL now, closing all the bugs. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 365 days |