Bug 1923869 - [DOCS] Incorrect descriptions with Disabling access to a build strategy globally about removing subresources from clusterrole
Summary: [DOCS] Incorrect descriptions with Disabling access to a build strategy globa...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Documentation
Version: 4.6
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: ---
: 4.6.z
Assignee: Kelly Brown
QA Contact: Jitendar Singh
Latha S
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-02-02 06:14 UTC by yhe
Modified: 2024-03-25 18:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-29 14:24:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description yhe 2021-02-02 06:14:07 UTC
Document URL: 
https://docs.openshift.com/container-platform/4.6/builds/securing-builds-by-strategy.html#builds-disabling-build-strategy-globally_securing-builds-by-strategy

Section Number and Name: 
Disabling access to a build strategy globally
--> 3. Ensure the build strategy subresources are also removed from these roles:
    4. For each role, remove the line that corresponds to the resource of the strategy to disable.

Describe the issue: 
There is no builds/docker、builds/source、builds/jenkinspipeline subresources in clusterrole/admin or clusterrole/edit.

$ oc get clusterrole admin -o yaml | grep builds
  - builds/details
  - builds
  - builds
  - builds/log
  - builds/clone
  - builds

$ oc get clusterrole edit -o yaml | grep builds
  - builds/details
  - builds
  - builds
  - builds/log
  - builds/clone
  - builds

Suggestions for improvement: 
Revise the step 3 and step 4, if these steps are not necessary, delete them. 
By the way, it seems worth mentioning that the steps introduced in the document about disabling access to a build strategy globally only take effect on the non-cluster-admin users. A cluster-admin user can still start a build even if all build strategies are disabled globally.

Additional information:

Comment 2 Kelly Brown 2021-11-11 15:24:31 UTC
PR for changes: https://github.com/openshift/openshift-docs/pull/38612


Note You need to log in before you can comment on or make changes to this bug.