Description of problem:
Cannot prevent serviceinstance updates by "planUpdatable: false" in clusterserviceclass.
service-catalog & asb image using images from brew registry:
Steps to Reproduce:
1. Provision a postgresql serviceinstance with "dev" plan in web console
2. Edit clusterserviceclass of postgresql, and set "planUpdatable: false"
3. Try to update serviceinstance plan from "dev" to "prod" by `oc edit serviceinstance dh-postgresql-apb-q5vjx -n $user_project` in backend.
3. Plan of erviceinstance can be updated succeed without any prevention in backend; Furthermore, plan update can be prevented succeed in web console(no "plan" page display to user while editing).
3. Should prevent plan of serviceinstance update by "planUpdatable: false" succeed both in backend and web console.
This is due to the Catalog admission controllers not being enabled. This is fixed upstream by https://github.com/kubernetes-incubator/service-catalog/pull/2013 and will be picked up by openshift soon.
This fix is in atomic-enterprise-service-catalog-3.10.0-0.40.0 and newer builds.
Changing status to ON_QA since image ready for test in downstream.
Verified and Passed with service catalog v3.10.0-0.41.0;Upstream:v0.1.18
# oc edit clusterserviceclass ddd528762894b277001df310a126d5ad
clusterserviceclass.servicecatalog.k8s.io "ddd528762894b277001df310a126d5ad" edited
[root@qe-zitang-gcemaster-etcd-1 ~]# oc edit serviceinstance -n test1
error: serviceinstances "dh-mysql-apb-qr8rg" could not be patched: serviceinstances.servicecatalog.k8s.io "dh-mysql-apb-qr8rg" is forbidden: The Service Class ddd528762894b277001df310a126d5ad does not allow plan changes.
You can run `oc replace -f /tmp/oc-edit-21nin.yaml` to try this update again.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.