Description of problem:
The image registry performs multi-part uploads to S3. To check on the status of these uploads requires the s3:ListMultipartUploadParts permission. This permissions is implicitly granted to the user/credentials who initiated the mutli-part upload.
In the event of a credentials rotation, the image registry could lose the ability to s3:ListMultipartUploadParts.
Version-Release number of selected component (if applicable):
@obulatov why the retargeting of release? This was discussed with @sdodson yesterday. We wanted to avoid introducing new permissions in 4.7.z with https://github.com/openshift/cluster-image-registry-operator/pull/640 , and the plan was to put the permission in for 4.7.0.
I haven't seen the PR and I didn't expect that my team will have time to fix it in 4.7.0. I'm ok to land it in 4.7.0, thank you for contributions.
$ oc get secrets -n openshift-image-registry installer-cloud-credentials -o yaml | grep ListMultipartUploadParts
Thanks for the info, Joel! Verified on 4.7.0-0.nightly-2021-01-19-095812:
1. Check the secret contains : s3:ListMultipartUploadParts:
$oc get secrets -n openshift-image-registry installer-cloud-credentials -o yaml
2. Delete the secret and IAM user from AWS console https://console.aws.amazon.com/iam/home?region=ap-southeast-1#/users;
3. Check the re-created secret and IAM user: qe-ui47-0120-n2d77-openshift-image-registry-nwz7p : they both contain : s3:ListMultipartUploadParts.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days