Description of problem: In 4.1, the commands `oc adm policy add/remove-scc-*` are broken if applied on an SCC from the default SCC set - they have a very short-lived effect since the platform-provided SCCs are handled by the cluster version operator (CVO). The aforementioned commands work by changing the Users/Groups fields of a specific SCC. If the SCC is one of the platform-provided, CVO will eventually stomp on the change and will revert it to platform-default Version-Release number of selected component (if applicable): 4.1 How reproducible: 100% Steps to Reproduce: 1. oc adm policy add-scc-to-user privileged milan 2. wait a bit Actual results: User "milan" won't eventually be able to set up pods that would require the "privileged" SCC . Expected results: User "milan" can create privileged pods unless removed from the "privileged" SCC by some other user. Additional info: WORKAROUND: =========== It is possible to create a cluster role that would allow the user "use" the "privileged" SCC. The process of creating the cluster role and role bindings to it is described in the official documentation: https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html#role-based-access-to-ssc-configuring-internal-oauth
https://github.com/openshift/origin/pull/22781
How does this affect docs? > https://docs.openshift.com/container-platform/4.1/cli_reference/administrator-cli-commands.html#policy
Sally, sync with Standa what needs to be done and let this ship in 4.4.
I've confirmed with latest version `Cluster version is 4.5.0-0.ci-2020-02-27-004716` that this is no longer an issue. I am able to: $ oc adm policy add-scc-to-user privileged testuser, then create a privileged pod. Also, I confirmed I can: $ oc adm policy remove-scc-from-user privileged testuser, then am no longer able to create the privileged pod.
Confirmed with latest oc client, the issue has fixed: [root@dhcp-140-138 v3-testfiles]# oc version -o yaml clientVersion: buildDate: "2020-02-28T23:32:38Z" compiler: gc gitCommit: bc08a48555986f64165555efd2705eff7ef2de81 gitTreeState: clean gitVersion: 4.4.0-202002282323-bc08a48 goVersion: go1.13.4 major: "" minor: "" platform: linux/amd64 [root@dhcp-140-138 home]# oc adm policy add-scc-to-user privileged testuser-2 securitycontextconstraints.security.openshift.io/privileged added to: ["testuser-2"] [yinzhou@localhost roottest]$ oc whoami testuser-2 [yinzhou@localhost roottest]$ oc get po -o yaml |grep privi openshift.io/scc: privileged privileged: true
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0581
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days