Red Hat Bugzilla – Bug 1470861
Ansible Service Broker: Change ServiceAccount to use 'admin' role
Last modified: 2017-11-28 03:28:38 EST
Description of problem: Ansible Service Broker uses 2 service accounts. Broker Service Account: We want this to be 'admin' + delta needed for basic operations (t.b.d.) Dynamic Service Account to run each APB: We want this to be 'admin'
> Dynamic Service Account to run each APB Where is these service accounts located? Are they in end-user-visible namespaces?
> Where is these service accounts located? Are they in end-user-visible namespaces? They're created in the requested namespace where the APB is run and deploys to; I assume this would be considered end-user-visible?
Installer side changes, adds admin permissions to broker: https://github.com/openshift/openshift-ansible/pull/4736
Drops APB permissions to admin: https://github.com/openshift/ansible-service-broker/pull/285
Checked with: # openshift version openshift v3.6.169 kubernetes v1.6.1+5115d708d7 etcd 3.2.1 and # asbd --version 0.9.9 and current serviceaccount asb is admin role on cluster level, and the sandbox serviceaccount is admin on project level. # oc get clusterrolebindings |grep -i asb admin /admin openshift-infra/template-instance-controller, kube-service-catalog/default, openshift-ansible-service-broker/asb [root@host-8-175-118 ~]# oc get rolebindings -n wjiang NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS admin /admin wjiang apb-1251e701-d777-4f93-9bed-2e7f9fd29c8e /admin apb-1251e701-d777-4f93-9bed-2e7f9fd29c8e system:deployers /system:deployer deployer system:image-builders /system:image-builder builder system:image-pullers /system:image-puller system:serviceaccounts:wjiang