Description of problem:
In 4.1, the commands `oc adm policy add/remove-scc-*` are broken if applied on an SCC from the default SCC set - they have a very short-lived effect since the platform-provided SCCs are handled by the cluster version operator (CVO).
The aforementioned commands work by changing the Users/Groups fields of a specific SCC. If the SCC is one of the platform-provided, CVO will eventually stomp on the change and will revert it to platform-default
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. oc adm policy add-scc-to-user privileged milan
2. wait a bit
User "milan" won't eventually be able to set up pods that would require the "privileged" SCC .
User "milan" can create privileged pods unless removed from the "privileged" SCC by some other user.
It is possible to create a cluster role that would allow the user "use" the "privileged" SCC. The process of creating the cluster role and role bindings to it is described in the official documentation: https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html#role-based-access-to-ssc-configuring-internal-oauth
How does this affect docs?
Sally, sync with Standa what needs to be done and let this ship in 4.4.
I've confirmed with latest version `Cluster version is 4.5.0-0.ci-2020-02-27-004716` that this is no longer an issue. I am able to:
$ oc adm policy add-scc-to-user privileged testuser, then create a privileged pod.
Also, I confirmed I can:
$ oc adm policy remove-scc-from-user privileged testuser, then am no longer able to create the privileged pod.
Confirmed with latest oc client, the issue has fixed:
[root@dhcp-140-138 v3-testfiles]# oc version -o yaml
[root@dhcp-140-138 home]# oc adm policy add-scc-to-user privileged testuser-2
securitycontextconstraints.security.openshift.io/privileged added to: ["testuser-2"]
[yinzhou@localhost roottest]$ oc whoami
[yinzhou@localhost roottest]$ oc get po -o yaml |grep privi
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.