Bug 1977093

Summary:	rbac role test failing in release-openshift-origin-installer-old-rhcos-e2e-aws-4.7
Product:	OpenShift Container Platform	Reporter:	Ben Parees <bparees>
Component:	Management Console	Assignee:	Jakub Hadvig <jhadvig>
Status:	CLOSED ERRATA	QA Contact:	Yadan Pei <yapei>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.6	CC:	aos-bugs, jhadvig, jokerman, sippy, yapei
Target Milestone:	---
Target Release:	4.6.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:	job=release-openshift-origin-installer-old-rhcos-e2e-aws-4.7=all
Last Closed:	2021-07-14 07:16:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ben Parees 2021-06-28 21:36:05 UTC

job:
release-openshift-origin-installer-old-rhcos-e2e-aws-4.7 

is always failing in CI, see testgrid results:
https://testgrid.k8s.io/redhat-openshift-ocp-release-4.7-informing#release-openshift-origin-installer-old-rhcos-e2e-aws-4.7


One of the primary test failures is:
fail [github.com/openshift/origin/test/extended/authorization/rbac/groups_default_rules.go:230]: Jun 26 22:50:31.634: system:authenticated has extra permissions in namespace "":
{APIGroups:["console.openshift.io"], Resources:["consoleplugins"], Verbs:["get" "list" "watch"]}
{APIGroups:["console.openshift.io"], Resources:["consolequickstarts"], Verbs:["get" "list" "watch"]}

So it appears there is a disconnect about expected RBAC rules related to the console.

sample job:
https://prow.ci.openshift.org/view/gs/origin-ci-test/logs/release-openshift-origin-installer-old-rhcos-e2e-aws-4.7/1408892345029496832

Comment 1 Jakub Hadvig 2021-06-29 08:53:17 UTC

So it's not really clear to me whats the issue here.
Looking at the ClusterRole for console extensions provided for logged-in user I see that the rules are read-only which is as should:
https://github.com/openshift/console-operator/blob/release-4.7/manifests/03-rbac-role-cluster-extensions.yaml

Also not sure why this is occurring only in 4.7 and not later versions.

Comment 2 Ben Parees 2021-06-29 16:33:06 UTC

fyi this job uses the test code from 4.6:

https://github.com/openshift/release/blob/f572056645f7536ac91857204edfaef8088f1766/ci-operator/jobs/openshift/release/openshift-release-release-4.7-periodics.yaml#L570

so perhaps that is part of the issue..... that the 4.6 test code expects one thing, but the 4.7 cluster is doing something else.

Comment 6 Yadan Pei 2021-07-05 08:48:31 UTC

Hi Jakub,

What changes have been made to fix the test failure? I didn't see any fix PRs attached

Comment 7 Jakub Hadvig 2021-07-06 09:31:01 UTC

This is the PR: https://github.com/openshift/origin/pull/26288

Comment 10 errata-xmlrpc 2021-07-14 07:16:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6.38 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2641

Comment 11 Red Hat Bugzilla 2023-09-15 01:10:42 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days