job: release-openshift-origin-installer-old-rhcos-e2e-aws-4.7 is always failing in CI, see testgrid results: https://testgrid.k8s.io/redhat-openshift-ocp-release-4.7-informing#release-openshift-origin-installer-old-rhcos-e2e-aws-4.7 One of the primary test failures is: fail [github.com/openshift/origin/test/extended/authorization/rbac/groups_default_rules.go:230]: Jun 26 22:50:31.634: system:authenticated has extra permissions in namespace "": {APIGroups:["console.openshift.io"], Resources:["consoleplugins"], Verbs:["get" "list" "watch"]} {APIGroups:["console.openshift.io"], Resources:["consolequickstarts"], Verbs:["get" "list" "watch"]} So it appears there is a disconnect about expected RBAC rules related to the console. sample job: https://prow.ci.openshift.org/view/gs/origin-ci-test/logs/release-openshift-origin-installer-old-rhcos-e2e-aws-4.7/1408892345029496832
So it's not really clear to me whats the issue here. Looking at the ClusterRole for console extensions provided for logged-in user I see that the rules are read-only which is as should: https://github.com/openshift/console-operator/blob/release-4.7/manifests/03-rbac-role-cluster-extensions.yaml Also not sure why this is occurring only in 4.7 and not later versions.
fyi this job uses the test code from 4.6: https://github.com/openshift/release/blob/f572056645f7536ac91857204edfaef8088f1766/ci-operator/jobs/openshift/release/openshift-release-release-4.7-periodics.yaml#L570 so perhaps that is part of the issue..... that the 4.6 test code expects one thing, but the 4.7 cluster is doing something else.
Hi Jakub, What changes have been made to fix the test failure? I didn't see any fix PRs attached
This is the PR: https://github.com/openshift/origin/pull/26288
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6.38 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:2641
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days