Bug 1591156

Document URL: 

Cluster-Roles are described here:
https://docs.openshift.com/container-platform/3.7/admin_guide/manage_rbac.html#viewing-cluster-roles

But we would need more info on how to modify a Cluster-Role.

Customer Usecase:
What is worrying me is the cluster reader is being able to read environment variables, as many projects tend to use it to store credentials.
It's a pity for _system to need cluster-reader in all its breadth.

So, if we could devise a trimmed down cluster-reader, i.e.
- foremost: not reading bc or dc or other env vars (anything with credentials)
- ideally: also being able to read _system metrics
that would be a great solution.

Currently, besides reading metrics, the role should be able to read projects annotations 
For example  openshift.io/description=XXX-123456,XXXX-12345,XX-1234567,ABC123456789012

While reading the cluster-reader definition, it is assumed that there is a difficulty that the Hawkular API collects objects first and then aggregates over or simply reads all their metrics. 
But what about [nodes/metrics nodes/spec] and [nodes/stats]?



What is further documented:

There is also a special tenant named _system which contains system level metrics. This requires either a cluster-reader or cluster-admin level privileges to access.
https://docs.openshift.com/container-platform/3.7/install_config/cluster_metrics.html



Regarding the procedure how to create it (Could this be documented?):
Resolution
You can create new cluster roles either from scratch or based on existing roles. One easy way is to base the role off an existing role.
Raw
$ oc get clusterrole admin -o yaml > newrole.yaml

This will create a yaml file called newrole. Modify the yaml file here to add or remove permissions. 
Also make sure to change the name and selfLink fields in the yaml from 'admin' to a new name, like newrole.

Now create the clusterrole:

oc create -f newrole.yaml
You can either grant it as a clusterrole which gives those permissions on ALL namespaces:
Raw
$ oadm policy add-cluster-role-to-user newrole example
That would give the newrole clusterrole to a user named example on ALL namespaces. Or, you can do so on a project-by-project basis:
Raw
$ oadm policy add-role-to-user newrole example -n default
That gives the newrole role to example in the default project. 


But this procedure created a yaml file which is quite complex and there seems to be no guideline what can be removed



Expectations of the bug:

1. Check if the Docu can be improved regarding creating Custom Cluster-Roles
2. Help on creating a new Cluster-Role to address customer issue