Bug 1842408
| Summary: | [csi-snapshot-controller] Clusterrole storage-admin should have access right to all APIs in snapshot.storage.k8s.io group | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Qin Ping <piqin> |
| Component: | Storage | Assignee: | Jan Safranek <jsafrane> |
| Storage sub component: | Operators | QA Contact: | Wei Duan <wduan> |
| Status: | CLOSED ERRATA | Docs Contact: | |
| Severity: | low | ||
| Priority: | medium | CC: | aos-bugs, jsafrane |
| Version: | 4.5 | ||
| Target Milestone: | --- | ||
| Target Release: | 4.6.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: Default OpenShift RBAC rules did not allow regular users to access VolumeSnapshot and VolumeSnapshotClass instances.
Consequence: Regular users cannot create VolumSnapshots or list VolumeSnapshotClasses.
Fix: Default OpenShift RBAC rules now include permissions for basic-user to read/write VolumeSnapshots and read VolumeSnapshotClasses. In addition, storage-admin can read/write VolumeSnapshotContents.
Result: Regular users can create VolumSnapshots or list VolumeSnapshotClasses.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-10-27 16:02:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Qin Ping
2020-06-01 08:22:20 UTC
It looks like that kubelet actually stores its iscsi.json file into the mounted volume! And in case the volume is read-only, it can't store the data there at all. This is wrong, kubelet should not touch data on the volume at all. Please disregard comment #1, wrong bug. Verified pass [wduan@MINT azuredisk]$ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.6.0-0.nightly-2020-07-16-211200 True False 7h6m Cluster version is 4.6.0-0.nightly-2020-07-16-211200 After giving this user the clusterfole of storage-admin: Could create/list VolumeSnapshotClass [wduan@MINT azuredisk]$ oc create -f VolumeSnapshotClass.yaml volumesnapshotclass.snapshot.storage.k8s.io/csi-snapclass-1 created [wduan@MINT azuredisk]$ oc get volumesnapshotclass NAME DRIVER DELETIONPOLICY AGE csi-snapclass disk.csi.azure.com Delete 82m csi-snapclass-1 disk.csi.azure.com Delete 14s Could list volumesnapshot [wduan@MINT azuredisk]$ oc get volumesnapshot NAME READYTOUSE SOURCEPVC SOURCESNAPSHOTCONTENT RESTORESIZE SNAPSHOTCLASS SNAPSHOTCONTENT CREATIONTIME AGE mysnapshot01 true pvc-ori 2Gi csi-snapclass snapcontent-a9c6fb76-17f8-44e2-85e5-684d952a1962 72m 74m Could list volumesnapshotcontent [wduan@MINT azuredisk]$ oc get volumesnapshotcontent snapcontent-a9c6fb76-17f8-44e2-85e5-684d952a1962 NAME READYTOUSE RESTORESIZE DELETIONPOLICY DRIVER VOLUMESNAPSHOTCLASS VOLUMESNAPSHOT AGE snapcontent-a9c6fb76-17f8-44e2-85e5-684d952a1962 true 2147483648 Delete disk.csi.azure.com csi-snapclass mysnapshot01 72m Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4196 |