Bug 1470824 - Revisit privileges granted to Service Accounts used by Ansible Service Broker
Revisit privileges granted to Service Accounts used by Ansible Service Broker
Product: OpenShift Container Platform
Classification: Red Hat
Component: Service Broker (Show other bugs)
Unspecified Unspecified
unspecified Severity low
: ---
: 3.7.0
Assigned To: John Matthews
Weihua Meng
Depends On:
  Show dependency treegraph
Reported: 2017-07-13 14:34 EDT by John Matthews
Modified: 2017-11-28 17:01 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2017-11-28 17:01:28 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3188 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Container Platform 3.7 security, bug, and enhancement update 2017-11-28 21:34:54 EST

  None (edit)
Description John Matthews 2017-07-13 14:34:21 EDT
Description of problem:

The Ansible Service Broker runs the broker under a service account with 'cluster-admin' rights.

Workflow is that when running an APB:
1. Create a new project (if it doesn't exist)
2. broker will dynamically create a new service account in that project
3. apb runs as the dynamic service account
4. broker deletes the dynamic service account
5. application/services running in the project

We plan to implement a means for an admin to opt into what security privileges they want an APB to run with, that is not in scope for 3.6.0 timeframe.

We would also like to reuse a common role between template broker and ansible service broker if possible.
Comment 1 Fabian von Feilitzsch 2017-07-18 14:14:54 EDT
Minor update, apbs will run as "admin", not "cluster-admin" in 3.6
Comment 2 John Matthews 2017-08-24 12:12:43 EDT
Below PR drops the role to 'edit' for the service account running an APB.


Summary of service accounts:
 Broker runs under 'asb' service account set to 'admin' through a ClusterRoleBinding

 APBs run under a temporary service account granted 'edit' through a RoleBinding in the target namespace.
Comment 4 Weihua Meng 2017-09-28 02:32:43 EDT
blocked by bug https://bugzilla.redhat.com/show_bug.cgi?id=1496426
Comment 5 Weihua Meng 2017-09-28 04:35:38 EDT
Verified on ansible-service-broker 1.0.4

docker run --entrypoint=asbd  openshift3/ose-ansible-service-broker:v3.7 --version

- apiVersion: v1
  groupNames: null
  kind: RoleBinding
    creationTimestamp: 2017-09-28T08:19:05Z
    name: apb-26122543-7202-41e4-866d-b9ad913822b8
    namespace: wmeng2
    resourceVersion: "44186"
    selfLink: /oapi/v1/namespaces/wmeng2/rolebindings/apb-26122543-7202-41e4-866d-b9ad913822b8
    uid: b1739e0a-a425-11e7-971a-fa163eeebea6
    name: edit
  - kind: ServiceAccount
    name: apb-26122543-7202-41e4-866d-b9ad913822b8
    namespace: wmeng2
  - system:serviceaccount:wmeng2:apb-26122543-7202-41e4-866d-b9ad913822b8
Comment 8 errata-xmlrpc 2017-11-28 17:01:28 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.