Bug 2236487

Summary:	global permission found for mtq operator in cnv csv.spec.install.spec
Product:	Container Native Virtualization (CNV)	Reporter:	Debarati Basu-Nag <dbasunag>
Component:	Virtualization	Assignee:	Barak <bmordeha>
Status:	CLOSED ERRATA	QA Contact:	Debarati Basu-Nag <dbasunag>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.14.5	CC:	acardace, bmordeha, dshchedr
Target Milestone:	---
Target Release:	4.14.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	v4.14.0.rhel9-2043	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-11-08 14:06:16 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Debarati Basu-Nag 2023-08-31 11:36:35 UTC

Description of problem:
global permission found for mtq operator in cnv csv.spec.install.spec

Version-Release number of selected component (if applicable):


How reproducible:
100%

Steps to Reproduce:
1. Check csv.spec.install.spec for mtq operator
2. 
3.

Actual results:
I see the following entries with global permission for mtq operator:
======================================
cluster_permission:
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  - roles
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  - customresourcedefinitions/status
  verbs:
  - '*'
- apiGroups:
  - mtq.kubevirt.io
  resources:
  - '*'
  verbs:
  - '*'
permission:
- apiGroups:
  - ''
  resources:
  - serviceaccounts
  - configmaps
  - events
  - secrets
  - services
  verbs:
  - '*'
- apiGroups:
  - apps
  resources:
  - deployments
  - deployments/finalizers
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - '*'
Expected results:
No global permission for mtq operator

Additional info:

Comment 2 Kedar Bidarkar 2023-09-19 11:10:43 UTC

Moving this bug back to ASSIGNED state, as per the above comment from Denys.

Comment 3 Barak 2023-09-19 11:40:44 UTC

Hey this should be resolved in v1.1.7  because of the following patch:

https://github.com/kubevirt/managed-tenant-quota/pull/23

Comment 4 Debarati Basu-Nag 2023-09-30 12:54:37 UTC

Validated with CNV-v4.14.0.rhel9-2121

Comment 6 errata-xmlrpc 2023-11-08 14:06:16 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Virtualization 4.14.0 Images security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:6817