Bug 1805442 - template-instance-controller can't deploy servicemonitors
Summary: template-instance-controller can't deploy servicemonitors
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Templates
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.5.0
Assignee: Adam Kaplan
QA Contact: XiuJuan Wang
Depends On:
TreeView+ depends on / blocked
Reported: 2020-02-20 19:31 UTC by Jim Minter
Modified: 2020-04-03 14:59 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-04-03 14:44:39 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Jim Minter 2020-02-20 19:31:26 UTC
Description of problem:

Can't deploy jenkins-ephemeral-monitored template via the web console

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Try to deploy jenkins-ephemeral-monitored template via the web console

Actual results:

InstantiateFailure error: servicemonitors.monitoring.coreos.com is forbidden: User "system:serviceaccount:openshift-infra:template-instance-controller" cannot create resource "servicemonitors" in API group "monitoring.coreos.com" in the namespace "xyz"

Expected results:

Should deploy

Additional info:

Comment 3 Adam Kaplan 2020-04-03 14:44:39 UTC
The TemplateInstance controller is intentionally limited in the types of objects it is allowed to create. Only core k8s workload resources are in the template instance controller's RBAC, and we do not intend on adding additional CRD-based resources in the future.

The recommended course of action in this situation is to create a new ClusterRole and aggregate it to the `edit` and `admin` roles [1]. When the template is instantiated, the template instance controller will effectively inherit these permissions and should be able to create these resources. Quoting the article:

>  If you are not comfortable granting these permissions to users directly, it is not safe to grant them to the template controllers.

[1] https://access.redhat.com/articles/4220601

Note You need to log in before you can comment on or make changes to this bug.