Bug 1927983
| Summary: | User cannot create the project when configuring a specific Resource Name in ClusterRole | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | yhe |
| Component: | apiserver-auth | Assignee: | David Eads <deads> |
| Status: | CLOSED NOTABUG | QA Contact: | pmali |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 4.6 | CC: | aos-bugs, deads, mfojtik, sttts |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-02-12 14:59:52 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
yhe
2021-02-12 01:44:38 UTC
You need also list permissions for projectrequests. One thing you may have overlooked, there is no name on CREATE requests, so an RBAC role trying to give permission to create a particularly name will not be honored. A second thing, permission to create a project is not the same as the permission to request a project. Granting project create will allow doing `oc create -f`, but will not allow `oc new-project` since you explicitly disabled self provisioning. Hi Thank you for looking into this issue. According to your explanation, I understand that I cannot request a project with `oc new-project` command since there is no name on CREATE requests. However, I tried to create a project with `oc create -f` command, yet still, an error occurs. Would you mind giving me some more details about what permission is necessary to create a project with a particular name? ``` $ oc describe clusterrole test-cluster-role Name: test-cluster-role Labels: <none> Annotations: <none> PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- projects [] [reserved-name] [create] projects.project.openshift.io [] [reserved-name] [create] $ oc adm policy add-cluster-role-to-user test-cluster-role user1 clusterrole.rbac.authorization.k8s.io/test-cluster-role added: "user1" $ oc login -u user1 Logged into "https://api.test.example.com:6443" as "user1" using existing credentials. $ cat project.yaml apiVersion: project.openshift.io/v1 kind: Project metadata: name: reserved-name $ oc create -f project.yaml Error from server (Forbidden): error when creating "project.yaml": projects.project.openshift.io is forbidden: User "user1" cannot create resource "projects" in API group "project.openshift.io" at the cluster scope $ oc login -u kubeadmin Authentication required for https://api.test.example.com:6443 (openshift) Username: kubeadmin Password: Login successful. $ oc create -f project.yaml project.project.openshift.io/reserved-name created $ oc project reserved-name Now using project "reserved-name" on server "https://api.test46yhe2.lab.upshift.rdu2.redhat.com:6443". ``` Thank you Yiyong There is no way to grant creation powers on a particularly named object for any resource in kubernetes. It is a restriction of the authorizer interface. This comment was flagged a spam, view the edit history to see the original text if required. This comment was flagged a spam, view the edit history to see the original text if required. |