Bug 1908747

Summary:	stale S3 CredentialsRequest in CCO manifest
Product:	OpenShift Container Platform	Reporter:	Joel Diaz <jdiaz>
Component:	Cloud Credential Operator	Assignee:	Joel Diaz <jdiaz>
Status:	CLOSED ERRATA	QA Contact:	wang lin <lwan>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	4.7	CC:	lwan
Target Milestone:	---
Target Release:	4.7.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: Recently deprecated functionality has orphaned unused CredentialsRequest object (cloud-credential-operator-s3). Consequence: Unnecessary CredentialsRequest object is left around (which a new cluster installation would not have). Fix: Clean up the resource which is no longer needed. Result: The cloud-credential-operator-s3 CredentialsRequest is removed and cleaned up from the cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-24 15:46:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Joel Diaz 2020-12-17 13:55:55 UTC

Description of problem:
Recently CCO removed the oidcdiscoveryendpoin controller. The oidcduscivertendpoint controller needed some AWS S3 permissions to perform its tasks and that was requested/granted through the CredentailsRequest named cloud-credential-operator-s3.

When the oidcdiscoverendpoint controller was removed, the CredentialsRequest piece was not removed.

Version-Release number of selected component (if applicable):
latest


How reproducible:
100%


Steps to Reproduce:
1. Install a nightly OpenShift
2. oc get credentialsrequest -n openshift-cloud-credential-operator cloud-credential-operator-s3 
3.

Actual results:
The object exists.


Expected results:
The object doesn't exist.


Additional info:
PR where oidcdiscoveryendpoint controller was removed: https://github.com/openshift/cloud-credential-operator/pull/276

Comment 3 wang lin 2020-12-18 03:13:55 UTC

I didn't realize CredentialsRequest cloud-credential-operator-s3-creds is used for oidcdiscoveryendpoin controller.

Verified on release:4.7.0-0.nightly-2020-12-17-201522

it has removed.

$oc get credentialsrequest -n openshift-cloud-credential-operator cloud-credential-operator-s3 
Error from server (NotFound): credentialsrequests.cloudcredential.openshift.io "cloud-credential-operator-s3" not found

Comment 6 errata-xmlrpc 2021-02-24 15:46:22 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633