Description of problem: The image registry performs multi-part uploads to S3. To check on the status of these uploads requires the s3:ListMultipartUploadParts permission. This permissions is implicitly granted to the user/credentials who initiated the mutli-part upload. In the event of a credentials rotation, the image registry could lose the ability to s3:ListMultipartUploadParts. Version-Release number of selected component (if applicable):
@obulatov why the retargeting of release? This was discussed with @sdodson yesterday. We wanted to avoid introducing new permissions in 4.7.z with https://github.com/openshift/cluster-image-registry-operator/pull/640 , and the plan was to put the permission in for 4.7.0.
I haven't seen the PR and I didn't expect that my team will have time to fix it in 4.7.0. I'm ok to land it in 4.7.0, thank you for contributions.
$ oc get secrets -n openshift-image-registry installer-cloud-credentials -o yaml | grep ListMultipartUploadParts cloudcredential.openshift.io/aws-policy-last-applied: '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:CreateBucket","s3:DeleteBucket","s3:PutBucketTagging","s3:GetBucketTagging","s3:PutBucketPublicAccessBlock","s3:GetBucketPublicAccessBlock","s3:PutEncryptionConfiguration","s3:GetEncryptionConfiguration","s3:PutLifecycleConfiguration","s3:GetLifecycleConfiguration","s3:GetBucketLocation","s3:ListBucket","s3:HeadBucket","s3:GetObject","s3:PutObject","s3:DeleteObject","s3:ListBucketMultipartUploads","s3:AbortMultipartUpload","s3:ListMultipartUploadParts"],"Resource":"*"},{"Effect":"Allow","Action":["iam:GetUser"],"Resource":"arn:aws:iam::301721915996:user/qe-ui47-0119-n59pr-openshift-image-registry-v2vd8"}]}'
Thanks for the info, Joel! Verified on 4.7.0-0.nightly-2021-01-19-095812: 1. Check the secret contains : s3:ListMultipartUploadParts: $oc get secrets -n openshift-image-registry installer-cloud-credentials -o yaml 2. Delete the secret and IAM user from AWS console https://console.aws.amazon.com/iam/home?region=ap-southeast-1#/users; 3. Check the re-created secret and IAM user: qe-ui47-0120-n2d77-openshift-image-registry-nwz7p : they both contain : s3:ListMultipartUploadParts.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:5633
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days