Bug 1908747 - stale S3 CredentialsRequest in CCO manifest
Summary: stale S3 CredentialsRequest in CCO manifest
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Cloud Credential Operator
Version: 4.7
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.7.0
Assignee: Joel Diaz
QA Contact: wang lin
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-12-17 13:55 UTC by Joel Diaz
Modified: 2021-02-24 15:46 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Recently deprecated functionality has orphaned unused CredentialsRequest object (cloud-credential-operator-s3). Consequence: Unnecessary CredentialsRequest object is left around (which a new cluster installation would not have). Fix: Clean up the resource which is no longer needed. Result: The cloud-credential-operator-s3 CredentialsRequest is removed and cleaned up from the cluster.
Clone Of:
Environment:
Last Closed: 2021-02-24 15:46:22 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cloud-credential-operator pull 278 0 None closed Bug 1908747: remove stale S3 CredentialsRequest manifests 2021-01-29 14:20:44 UTC
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:46:37 UTC

Description Joel Diaz 2020-12-17 13:55:55 UTC 
Description of problem:
Recently CCO removed the oidcdiscoveryendpoin controller. The oidcduscivertendpoint controller needed some AWS S3 permissions to perform its tasks and that was requested/granted through the CredentailsRequest named cloud-credential-operator-s3.

When the oidcdiscoverendpoint controller was removed, the CredentialsRequest piece was not removed.

Version-Release number of selected component (if applicable):
latest


How reproducible:
100%


Steps to Reproduce:
1. Install a nightly OpenShift
2. oc get credentialsrequest -n openshift-cloud-credential-operator cloud-credential-operator-s3 
3.

Actual results:
The object exists.


Expected results:
The object doesn't exist.


Additional info:
PR where oidcdiscoveryendpoint controller was removed: https://github.com/openshift/cloud-credential-operator/pull/276
Comment 3 wang lin 2020-12-18 03:13:55 UTC 
I didn't realize CredentialsRequest cloud-credential-operator-s3-creds is used for oidcdiscoveryendpoin controller.

Verified on release:4.7.0-0.nightly-2020-12-17-201522

it has removed.

$oc get credentialsrequest -n openshift-cloud-credential-operator cloud-credential-operator-s3 
Error from server (NotFound): credentialsrequests.cloudcredential.openshift.io "cloud-credential-operator-s3" not found
Comment 6 errata-xmlrpc 2021-02-24 15:46:22 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633
Note You need to log in before you can comment on or make changes to this bug.