Bug 1830995

Summary:	MasterIamRole requires elasticloadbalancing:ModifyTargetGroupAttributes and couple other Describe rules
Product:	OpenShift Container Platform	Reporter:	Stephen Cuppett <scuppett>
Component:	Installer	Assignee:	Stephen Cuppett <scuppett>
Installer sub component:	openshift-installer	QA Contact:	Yunfei Jiang <yunjiang>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	medium	CC:	cshulman, knewcome, yunjiang
Version:	4.5	Flags:	scuppett: needinfo- scuppett: needinfo-
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-13 17:34:39 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Stephen Cuppett 2020-05-04 13:17:51 UTC

Description of problem:

As reported by account team working with this change, the following permissions are also observed needed on MasterIamRole when modifying default ingress to be internal:

"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInternetGateways",
"elasticloadbalancing:DescribeInstanceHealth",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:ModifyTargetGroupAttributes",

Version-Release number of the following components:

OpenShift 4.5

How reproducible:

Always

Steps to Reproduce:
1. Install 4.5
2. Attempt to convert ingress to internal
3. Doesn't take.

Actual results:

No internal ingress is rendered.

Expected results:

It should.

Additional info:

Comment 6 errata-xmlrpc 2020-07-13 17:34:39 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409