Bug 1391058 - Removing view role from service account takes no effect
Summary: Removing view role from service account takes no effect
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.3.1
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Jordan Liggitt
QA Contact: Chuan Yu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-02 13:40 UTC by pdrobek
Modified: 2016-11-04 20:17 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-04 20:17:40 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description pdrobek 2016-11-02 13:40:40 UTC
Description of problem:
Adding view role to service account and then taking it back takes no effect, container is still able to view openshift resources

Version:
openshift v3.3.1.3
kubernetes v1.3.0+52492b4

How reproducible:
Every time

Steps to Reproduce:
1. Deploy any pod using default service account in testnamespace
2. run: oc policy add-role-to-user view system:serviceaccount:testnamespace:default -n testnamespace
3. run in container terminal:
bearerHeader="Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
url="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/namespaces/testnamespace/pods"
curl -G -k -H "${bearerHeader}" ${url}
4. see getting pods in your namespace
5. run: oc policy add-role-to-user view system:serviceaccount:testnamespace:default -n testnamespace
6. run again in same container terminal: curl -G -k -H "${bearerHeader}" ${url}

Actual results:
Getting pods in namespace

Expected results:
Should get 403 unauthorized

Additional info:
Works properly in version:
oc v3.3.0.35
kubernetes v1.3.0+52492b4

Comment 1 Jordan Liggitt 2016-11-02 17:17:02 UTC
was step 5 supposed to be "oc policy remove-role-from-user view system:serviceaccount:testnamespace:default -n testnamespace"?

When I remove the role, I get the forbidden error as expected.

Comment 2 pdrobek 2016-11-03 08:25:10 UTC
Yes, step 5 was meant to remove the role.

Retried again and noted that default service account is able to get resources even without adding view role (it doesn't have the role). Might it be configured somewhere, that default service account is authorized to see resources no matter if it has the appropriate role?

Comment 3 Jordan Liggitt 2016-11-03 12:45:53 UTC
By default, that service account has no API permissions.

Do you have a custom project template set up?
Have you granted any cluster-wide permissions?

What does the following show:

oc get rolebindings -n testnamespace -o yaml
oc get clusterrolebindings -o yaml

Comment 4 pdrobek 2016-11-04 13:42:20 UTC
It showed up that into our cluster role bindings got policy cluster-reader for group system:serviceaccounts. After removing this policy everything works as expected.


Note You need to log in before you can comment on or make changes to this bug.