Bug 1907505

Summary: [ExternalIP] Only a user with cluster-admin privileges can create a policy object
Product: OpenShift Container Platform Reporter: Weibin Liang <weliang>
Component: DocumentationAssignee: Jason Boxman <jboxman>
Status: CLOSED CURRENTRELEASE QA Contact: Xiaoli Tian <xtian>
Severity: medium Docs Contact: Vikram Goyal <vigoyal>
Priority: unspecified    
Version: 4.6CC: aos-bugs, jboxman, jokerman, shsaxena
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-06 03:31:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Weibin Liang 2020-12-14 16:20:49 UTC
Document URL: 
https://docs.openshift.com/container-platform/4.6/networking/configuring_ingress_cluster_traffic/configuring-externalip.html

Section Number and Name: 
https://docs.openshift.com/container-platform/4.6/networking/configuring_ingress_cluster_traffic/configuring-externalip.html#nw-externalip-about_configuring-externalip

Describe the issue: 
By default, only a user with cluster-admin privileges can create a Service with spec.externalIPs[] set to IP addresses defined within an external IP address block.

Suggestions for improvement: 
By default, only a user with cluster-admin privileges can create a policy object with spec.externalIPs[] set to IP addresses defined within an external IP address block.

Additional information:

Comment 1 Jason Boxman 2021-01-19 02:45:56 UTC
From the Jira ticket:

> non-cluster-admin can only set external IP if inside a range in policy

So wouldn't that mean the update proposed here should be both of the following:

- "A user can create a Service with spec.externalIPs[] set to IP addresses defined within an external IP address block."
- "A cluster-admin can create a Service with spec.externalIPs[] set to anything."

Is that correct?

Thanks!

Comment 2 Weibin Liang 2021-01-19 15:02:39 UTC
(In reply to Jason Boxman from comment #1)
> From the Jira ticket:
> 
> > non-cluster-admin can only set external IP if inside a range in policy
> 
> So wouldn't that mean the update proposed here should be both of the
> following:
> 
> - "A user can create a Service with spec.externalIPs[] set to IP addresses
> defined within an external IP address block."
> - "A cluster-admin can create a Service with spec.externalIPs[] set to
> anything."
> 
> Is that correct?
> 
> Thanks!

I think the correct information in our doc should be something like:

User can create a service to set externalIPs by : “oc create -f $servicename.yaml”
cluster-admin privileges can create a policy object with spec.externalIPs[] by: “oc edit network.config.openshift.io cluster  -o json”. 

User do not have privilege to execute :“oc edit network.config.openshift.io cluster  -o json”.

Comment 3 Jason Boxman 2021-01-29 03:22:05 UTC
Proposed PR: https://github.com/openshift/openshift-docs/pull/28953

Comment 4 Jason Boxman 2021-03-01 03:23:49 UTC
Hi,

I've clarified the language for this feature:

```
= About ExternalIP

For non-cloud environments, {product-title} supports the assignment of external IP addresses to a `Service` object `spec.externalIPs[]` field through the *ExternalIP* facility.
By setting this field, {product-title} assigns an additional virtual IP address to the service. The IP address can be outside the service network defined for the cluster.
A service configured with an ExternalIP functions similarly to a service with `type=NodePort`, allowing you to direct traffic to a local node for load balancing.

You must configure your networking infrastructure to ensure that the external IP address blocks that you define are routed to the cluster.

{product-title} extends the ExternalIP functionality in Kubernetes by adding the following capabilities:

- Restrictions on the use of external IP addresses by users through a configurable policy
- Allocation of an external IP address automatically to a service upon request

~~By default, only a user with `cluster-admin` privileges can create a `Service` object with `spec.externalIPs[]` set to IP addresses defined within an external IP address block.~~ (deleted)
```

And then, to clarify that restrictions do not apply to a cluster-admin:

```
== Restrictions on the assignment of an external IP address

As a cluster administrator, you can specify IP address blocks to allow and to reject.

Restrictions apply only to users without `cluster-admin` privileges. A cluster administrator can always set the service `spec.externalIPs[]` field to any IP address.
```

Does this help clarify the issue?

Thanks!

Comment 5 Weibin Liang 2021-03-01 18:16:31 UTC
LGTM for https://github.com/openshift/openshift-docs/pull/28953