+++ This bug was initially created as a clone of Bug #1977920 +++ Description of problem: A pod using a SA which has only access to an SCC with a specific (defined) set of volumes will fail to launch. This is because 1.21 is moving to bound tokens which are using projected volumes. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. SA with custom SCC which has secrets + hostpath is set 2. Create pod with SA 3. Create pod Actual results: Pod fails to launch CNV HPP fails to launch, see bug #1977179 Expected results: Pod launches Additional info: This is addressed by adding th projected volume to the custom SCC. Hwoeveer, this is not possible in 4.7 as the volume type did not exist back then. --- Additional comment from Fabian Deutsch on 2021-06-30 17:40:44 UTC --- https://github.com/awels/hostpath-provisioner-operator/blob/master/pkg/controller/hostpathprovisioner/scc.go#L112 is an affected SCC
Besides the verification against fresh env, one more checkpoint needing to cover comes to my brain - upgrade testing: In 4.7 fresh env, create SCC that keeps 'secret' but has 'projected' removed, then upgrade it to latest 4.8; after upgrade, test the SCC is added with 'projected'.
(In reply to Xingxing Xia from comment #4) Update: after upgrade, not test the SCC is added with 'projected', rather, test if the app pod that depends on the SCC can be still run.
Tested in cluster 4.8.0-0.nightly-2021-07-02-124716 1. create new SCC without 'projected' volume type $ oc get scc hostaccess -o yaml > myscc.yaml $ sed -i -e "/- projected/d" -e "s/hostaccess/myscc/" myscc.yaml $ oc create -f myscc.yaml 2. add the new SCC to SA default $ oc login -u testuser $ oc new-project test $ oc adm policy add-scc-to-user myscc -z default -n test --context admin 3. create pod and check whether pod can be launched successfully $ cat > pod.yaml << EOF apiVersion: v1 kind: Pod metadata: name: testpod spec: containers: - image: quay.io/openshifttest/hello-pod:latest name: testpod volumeMounts: - mountPath: /host name: myvolume volumes: - hostPath: path: / name: myvolume EOF $ oc create -f pod.yaml $ oc get pods -n test NAME READY STATUS RESTARTS AGE testpod 1/1 Running 0 26s Tested after upgrade from 4.7.0-0.nightly-2021-07-03-010214 1. follow above test steps to create test pod using SCC without 'projected' volume type $ oc get pods NAME READY STATUS RESTARTS AGE testpod 1/1 Running 0 12s 2. upgrade cluster oc adm upgrade --to-image=registry.ci.openshift.org/ocp/release:4.8.0-0.nightly-2021-07-02-124716 --force=true --allow-explicit-upgrade=true 3. check whether testpod is still running $ oc get pods NAME READY STATUS RESTARTS AGE testpod 1/1 Running 0 102m
No doc update required - this was a bug introduced and fixed in 4.8 prior to release.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:2438