Bug 1536304
| Summary: | Project admin could create daemonsets in its namespace | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Chuan Yu <chuyu> | |
| Component: | apiserver-auth | Assignee: | Mo <mkhan> | |
| Status: | CLOSED NOTABUG | QA Contact: | Chuan Yu <chuyu> | |
| Severity: | urgent | Docs Contact: | ||
| Priority: | urgent | |||
| Version: | 3.9.0 | CC: | aos-bugs, chuyu, dma, jokerman, mfojtik, mkhan, mmccomas, ssorce, tnozicka | |
| Target Milestone: | --- | Keywords: | Regression | |
| Target Release: | 3.9.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1555363 1574773 (view as bug list) | Environment: | ||
| Last Closed: | 2018-05-04 12:44:09 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1501514, 1571093 | |||
Do you have any logs we culd look at ? Moving to ansible based on above comment/logs The logs are gone unfortunately, can you reproduce and attach the logs to this bug so they're persisted indefinitely? Also, what's pm1 user? This is the PR, please comment and approve/nit as needed: https://github.com/openshift/origin/pull/18971 Commits pushed to master at https://github.com/openshift/origin https://github.com/openshift/origin/commit/087d7660b4534442aed41346fee3a125e0ab0497 UPSTREAM: <carry>: Remove write permissions on daemonsets from Kubernetes bootstrap policy Due to how daemonsets interact with the project node selector, we need to limit write access to them to the cluster admin. Bug 1536304 Bug 1501514 Signed-off-by: Monis Khan <mkhan> https://github.com/openshift/origin/commit/a42347be22a9bb53fcc4bbb088e4f4074cb54c76 Update policy tests to reflect removal of write access on daemonsets Bug 1536304 Bug 1501514 Signed-off-by: Monis Khan <mkhan> https://github.com/openshift/origin/commit/4514d3540e0c16f31cf59feb19273c1d7f5bb7a1 Merge pull request #18971 from enj/enj/i/disable_daemonset_carry/1536304,1501514 Automatic merge from submit-queue. UPSTREAM: <carry>: Remove write permissions on daemonsets from Kubernetes bootstrap policy Due to how daemonsets interact with the project node selector, we need to limit write access to them to the cluster admin. Bug 1536304 Bug 1501514 Signed-off-by: Monis Khan <mkhan> /kind bug /assign @liggitt @deads2k @simo5 @smarterclayton @openshift/sig-security /cherrypick release-3.9 Verified. # openshift version openshift v3.9.11 kubernetes v1.9.1+a0ce1bc657 etcd 3.2.16 Commit pushed to master at https://github.com/openshift/openshift-docs https://github.com/openshift/openshift-docs/commit/ea979387b6c874dd99a2e5442b327edf15e20fa6 Undo changes to daemonset RBAC docs Revert "Remove daemonset from RBAC docs" This reverts commit 9912d863c3ff2c7333e4aaa42e4b6efe42abc3ec. Revert "Removed link to Granting Users Daemonset Permissions as followup to PR#7981" This reverts commit 015ed3852fd0344c6a49495db76277f0316ce832. Bug 1536304 Bug 1501514 This issue happen again. # openshift version openshift v3.9.27 kubernetes v1.9.1+a0ce1bc657 Clone a new one to track. Per David Eads in https://bugzilla.redhat.com/show_bug.cgi?id=1555363#c5: > https://github.com/openshift/ose/pull/1205 merged, so the controller doesn't > create pods it knows will be rejected. "fixing" the default role to > disallow the creation of a daemonset was a bug. The change is merged as of v3.9.26-1 This readds the deamonset permission as it is safe for normal users to have. Thus this is the expected behavior. |
Description of problem: Project admin could create/delete daemonsets in its namesapce Version-Release number of selected component (if applicable): # openshift version openshift v3.9.0-0.21.0 kubernetes v1.9.1+a0ce1bc657 etcd 3.2.8 How reproducible: always Steps to Reproduce: 1.user create daemonset in its namespace 2. 3. Actual results: the daemonset create successfully. Expected results: user without system:admin sudoer could not create daemonset in its namespace Additional info: $ oc policy who-can create daemonset -n chuyu Namespace: chuyu Verb: create Resource: daemonsets.extensions Users: pm1 system:admin system:serviceaccount:kube-service-catalog:default system:serviceaccount:kube-system:clusterrole-aggregation-controller system:serviceaccount:openshift-ansible-service-broker:asb system:serviceaccount:openshift-infra:template-instance-controller Groups: system:cluster-admins system:masters $ oc whoami pm1