Bug 1977924

Summary:	Pod fails to run when a custom SCC with a specific set of volumes is used
Product:	OpenShift Container Platform	Reporter:	Sergiusz Urbaniak <surbania>
Component:	apiserver-auth	Assignee:	Maru Newby <mnewby>
Status:	CLOSED ERRATA	QA Contact:	liyao
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	4.8	CC:	alitke, aos-bugs, bparees, fdeutsch, liyao, mfojtik, mnewby, sttts, surbania, vlaad, xxia, yadu, ycui
Target Milestone:	---	Keywords:	FastFix, Regression
Target Release:	4.8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	1977920	Environment:
Last Closed:	2021-07-27 23:13:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1977920
Bug Blocks:

Description Sergiusz Urbaniak 2021-06-30 17:45:23 UTC

+++ This bug was initially created as a clone of Bug #1977920 +++

Description of problem:
A pod using a SA which has only access to an SCC with a specific (defined) set of volumes will fail to launch.

This is because 1.21 is moving to bound tokens which are using projected volumes.

Version-Release number of selected component (if applicable):


How reproducible:
Always 

Steps to Reproduce:
1. SA with custom SCC which has secrets + hostpath is set
2. Create pod with SA
3. Create pod

Actual results:
Pod fails to launch

CNV HPP fails to launch, see bug #1977179

Expected results:
Pod launches

Additional info:
This is addressed by adding th projected  volume to the custom SCC.
Hwoeveer, this is not possible in 4.7 as the volume type did not exist back then.

--- Additional comment from Fabian Deutsch on 2021-06-30 17:40:44 UTC ---

https://github.com/awels/hostpath-provisioner-operator/blob/master/pkg/controller/hostpathprovisioner/scc.go#L112 is an affected SCC

Comment 4 Xingxing Xia 2021-07-05 01:51:42 UTC

Besides the verification against fresh env, one more checkpoint needing to cover comes to my brain - upgrade testing:
In 4.7 fresh env, create SCC that keeps 'secret' but has 'projected' removed, then upgrade it to latest 4.8; after upgrade, test the SCC is added with 'projected'.

Comment 5 Xingxing Xia 2021-07-05 04:04:12 UTC

(In reply to Xingxing Xia from comment #4)
Update: after upgrade, not test the SCC is added with 'projected', rather, test if the app pod that depends on the SCC can be still run.

Comment 6 liyao 2021-07-05 10:33:06 UTC

Tested in cluster 4.8.0-0.nightly-2021-07-02-124716
1. create new SCC without 'projected' volume type
$ oc get scc hostaccess -o yaml > myscc.yaml
$ sed -i -e "/- projected/d" -e "s/hostaccess/myscc/" myscc.yaml
$ oc create -f myscc.yaml

2. add the new SCC to SA default
$ oc login -u testuser
$ oc new-project test
$ oc adm policy add-scc-to-user myscc -z default -n test --context admin

3. create pod and check whether pod can be launched successfully
$ cat > pod.yaml << EOF
apiVersion: v1
kind: Pod
metadata:
  name: testpod
spec:
  containers:
  - image: quay.io/openshifttest/hello-pod:latest
    name: testpod
    volumeMounts:
    - mountPath: /host
      name: myvolume
  volumes:
  - hostPath:
      path: /
    name: myvolume
EOF
$ oc create -f pod.yaml 
$ oc get pods -n test
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          26s


Tested after upgrade from 4.7.0-0.nightly-2021-07-03-010214
1. follow above test steps to create test pod using SCC without 'projected' volume type
$ oc get pods
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          12s

2. upgrade cluster
oc adm upgrade --to-image=registry.ci.openshift.org/ocp/release:4.8.0-0.nightly-2021-07-02-124716 --force=true --allow-explicit-upgrade=true

3. check whether testpod is still running
$ oc get pods
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          102m

Comment 7 Maru Newby 2021-07-07 17:51:05 UTC

No doc update required - this was a bug introduced and fixed in 4.8 prior to release.

Comment 9 errata-xmlrpc 2021-07-27 23:13:47 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438