Bug 1871051

Summary: AWS EBS CSI driver needs permission to patch volumeattachment/status
Product: OpenShift Container Platform Reporter: Jan Safranek <jsafrane>
Component: StorageAssignee: Jan Safranek <jsafrane>
Storage sub component: Operators QA Contact: Qin Ping <piqin>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: unspecified CC: aos-bugs, jzmeskal
Version: 4.6   
Target Milestone: ---   
Target Release: 4.6.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-10-27 16:30:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Safranek 2020-08-21 08:40:35 UTC 
As part of rebase of CSI sidecars to 1.19 versions, external-attacher now needs permissions to PATCH volumeattachment/status.

Steps to reproduce:

1. install the CSI driver
2. check external-attacher version
3. run a pod with a volume provided by the driver

Actual results:

3. The pod is Pending, external-attacher logs:

I0821 08:22:24.981208       1 csi_handler.go:218] Error processing "csi-32f278e4d2a003e5255bac9d84303473a9e9e20175dd8fa695f1b659dc01315e": failed to mark as attached: volumeattachments.storage.k8s.io "csi-32f278e4d2a003e5255bac9d84303473a9e9e20175dd8fa695f1b659dc01315e" is forbidden: User "system:serviceaccount:openshift-cluster-csi-drivers:aws-ebs-csi-driver-controller-sa" cannot patch resource "volumeattachments/status" in API group "storage.k8s.io" at the cluster scope

Expected result:

2. external-attacher is at v3.0.0 (https://github.com/openshift/csi-external-attacher/pull/22)

3. The pod runs


Users / QA should not be able to even hit this, as we patch the RBAC rules before merging the attacher. In CI, it looked like this:

https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/openshift_csi-external-attacher/22/pull-ci-openshift-csi-external-attacher-master-e2e-aws-csi/1296500248352395264

(and thanks to CI to find this out)
Comment 1 Jan Zmeskal 2020-08-24 14:14:40 UTC 
*** Bug 1871820 has been marked as a duplicate of this bug. ***
Comment 4 Qin Ping 2020-08-26 03:07:21 UTC 
Verified with: 4.6.0-0.nightly-2020-08-25-222652
Comment 6 errata-xmlrpc 2020-10-27 16:30:14 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4196