Bug 1833558 - oc adm policy add-scc-to-user to create Roles and RoleBindings
Summary: oc adm policy add-scc-to-user to create Roles and RoleBindings
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oc
Version: 4.5
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.5.0
Assignee: Maciej Szulik
QA Contact: zhou ying
Depends On:
TreeView+ depends on / blocked
Reported: 2020-05-08 21:56 UTC by Maciej Szulik
Modified: 2020-07-13 17:37 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: add-scc-to-user was modifying SCC directly. Consequence: In 4.x architecture it's the operator role to manage built-in SCC. Fix: oc adm policy add-scc-to-user should create rather assign Roles containing the SCC, so they are preserved during operator reconciliation. Result: Operator reconciling built-in SCC will not affect SCCs assigned to a user.
Clone Of:
Last Closed: 2020-07-13 17:36:32 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift cluster-kube-apiserver-operator pull 856 0 None closed Bug 1833558: create cluster roles for modiyfing scc-s 2020-12-07 15:34:09 UTC
Github openshift oc pull 412 0 None closed Bug 1833558: create ClusteRole and ClusterRoleBinding when invoking oc adm policy add-scc-to-user 2020-12-07 15:34:09 UTC
Github openshift origin pull 25032 0 None closed Bug 1833558: update test to be more resilient for oc adm policy add-sss-to-user changes 2020-12-07 15:34:09 UTC
Red Hat Product Errata RHBA-2020:2409 0 None None None 2020-07-13 17:37:23 UTC

Description Maciej Szulik 2020-05-08 21:56:52 UTC
Currently oc adm policy add-scc-to-user modifies SCC directly but should rather create appropriate ClusterRole and ClusterRoleBinding instead and not modify SCC at all.

Comment 1 Maciej Szulik 2020-05-20 08:26:28 UTC
PRs in the queue.

Comment 4 zhou ying 2020-06-01 02:45:40 UTC
Confirmed with latest oc , the issue has fixed:

[root@dhcp-140-138 ~]# oc version --client -o yaml 
  buildDate: "2020-05-29T14:24:36Z"
  compiler: gc
  gitCommit: 9933eb90790b36d153fcc55f8404724bb0929b96
  gitTreeState: clean
  gitVersion: 4.5.0-202005291417-9933eb9
  goVersion: go1.13.4
  major: ""
  minor: ""
  platform: linux/amd64

[root@dhcp-140-138 ~]# oc  adm policy add-scc-to-user privileged testuser-1
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:privileged added: "testuser-1"

[root@dhcp-140-138 ~]# oc get clusterrole |grep privileged
system:openshift:scc:privileged                                        2020-06-01T00:28:23Z

[root@dhcp-140-138 ~]# oc get clusterrolebinding |grep privileged
system:openshift:scc:privileged                                                  ClusterRole/system:openshift:scc:privileged                                        2m49s

Comment 5 errata-xmlrpc 2020-07-13 17:36:32 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.