Bug 2036827
Summary: | The ccoctl still accepts CredentialsRequests without ServiceAccounts on GCP platform | ||
---|---|---|---|
Product: | OpenShift Container Platform | Reporter: | wang lin <lwan> |
Component: | Cloud Credential Operator | Assignee: | Nobody <nobody> |
Status: | CLOSED ERRATA | QA Contact: | wang lin <lwan> |
Severity: | medium | Docs Contact: | |
Priority: | high | ||
Version: | 4.10 | ||
Target Milestone: | --- | ||
Target Release: | 4.10.0 | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2022-03-12 04:40:32 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
wang lin
2022-01-04 06:41:03 UTC
Verified on 4.10.0-0.nightly-2022-01-05-052228 without serviceaccount, ccoctil will throw: $ ./ccoctl gcp create-all --credentials-requests-dir credrequests-gcp --name lwan-gcp-0105 --project openshift-qe --region us-central1 --output-dir test-gcp-secret 2022/01/05 13:58:09 Credentials loaded from file "/home/lwan/.gcp/osServiceAccount.json" 2022/01/05 13:58:09 Using existing RSA keypair found at test-gcp-secret/serviceaccount-signer.private 2022/01/05 13:58:09 Copying signing key for use by installer 2022/01/05 13:58:11 workload identity Pool created with name lwan-gcp-0105 2022/01/05 13:58:12 Bucket lwan-gcp-0105-oidc created 2022/01/05 13:58:14 Bucket lwan-gcp-0105-oidc is set to be publicly readable 2022/01/05 13:58:15 OpenID Connect discovery document in the S3 bucket lwan-gcp-0105-oidc at .well-known/openid-configuration updated 2022/01/05 13:58:15 Reading public key 2022/01/05 13:58:15 JSON web key set (JWKS) in the S3 bucket lwan-gcp-0105-oidc at keys.json updated 2022/01/05 13:58:16 workload identity provider created with name lwan-gcp-0105 2022/01/05 13:58:19 IAM Service account lwan-gcp-0105-openshift-g created 2022/01/05 13:58:22 Saved credentials configuration to: test-gcp-secret/manifests/openshift-cloud-controller-manager-gcp-ccm-cloud-credentials-credentials.yaml 2022/01/05 13:58:22 Failed to create IAM service accounts: Failed while processing each CredentialsRequest: CredentialsRequest openshift-cloud-credential-operator/openshift-cluster-api-gcp must provide at least one ServiceAccount in .spec.ServiceAccountNames Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056 |