Bug 1911307 - Pod Scale-up requires extra privileges in OpenShift web-console
Summary: Pod Scale-up requires extra privileges in OpenShift web-console
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Management Console
Version: 4.5
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.7.0
Assignee: Jakub Hadvig
QA Contact: Yadan Pei
URL:
Whiteboard:
: 1886888 (view as bug list)
Depends On:
Blocks: 1926371
TreeView+ depends on / blocked
 
Reported: 2020-12-28 17:10 UTC by Rejeeb
Modified: 2022-03-04 16:30 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Scale pods is not using the 'scale' subresource. Consequence: Custom role without patch verb for deploymentconfigs/deployments can't scale the pods in the webconsole. Fix: Scale pods using the 'scale' subresource. Result: Scaling happens without adding any extra privileges through webconsole.
Clone Of:
Environment:
Last Closed: 2021-02-24 15:49:10 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift console pull 7807 0 None closed Bug 1911307: scale pods using the 'scale' subresource 2021-02-18 15:53:27 UTC
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:49:26 UTC

Description Rejeeb 2020-12-28 17:10:07 UTC
Description of problem:
Without the `patch` verb for the `deployments`/`deploymentconfigs` resource, we cannot scale the deployments/deploymentconfigs through the web console. We need to provide an extra `patch` verb in order to scale up pods through the web-console. However, through CLI the pods' replica scale-up works without the `patch` verb.


Version-Release number of selected component (if applicable):
4.5


How reproducible:
100%

Steps to Reproduce:
1. Create a custom role without patch verb for deploymentconfigs/deployments (Attachment #1 [details])
2. Then assign the role to the user. 
3. Now try to scale the pods through webconsole and CLI.

Actual results:
Through CLI it is working as expected:

[quicklab@upi-0 ~]$ oc scale dc httpd --replicas=2
deploymentconfig.apps.openshift.io/httpd scaled

However, through webconsole, we need to provide the patch verb or else it won't show the arrows for calling the pods. 

Expected results:

Scaling should happen without adding any extra privileges through webconsole as done via CLI.

Additional info:
Attaching a sample custom role YAML file and screenshots of the webconsole.

Comment 9 Yadan Pei 2021-01-14 09:30:03 UTC
1. Create a custom role from attachment 1 [details]
2. Then assign the role to the user.
# oc adm policy add-cluster-role-to-user ops yapei
Warning: User 'yapei' not found
clusterrole.rbac.authorization.k8s.io/ops added: "yapei" 
3. Now try to scale the pods through webconsole, on DC Details page, we can see scale up/down arrow in pod donut, `Edit Pod count` kebab is also available 
4. try to scale the pods through CLI, it works well


Verified on 4.7.0-0.nightly-2021-01-13-124141

Comment 17 errata-xmlrpc 2021-02-24 15:49:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633

Comment 18 Christoph Jerolimov 2022-03-04 16:30:51 UTC
*** Bug 1886888 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.