Bug 1977924 - Pod fails to run when a custom SCC with a specific set of volumes is used
Summary: Pod fails to run when a custom SCC with a specific set of volumes is used
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 4.8
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 4.8.0
Assignee: Maru Newby
QA Contact: liyao
URL:
Whiteboard:
Depends On: 1977920
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-30 17:45 UTC by Sergiusz Urbaniak
Modified: 2021-07-27 23:14 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of: 1977920
Environment:
Last Closed: 2021-07-27 23:13:47 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift apiserver-library-go pull 53 0 None closed [release-4.8] Bug 1977924: Ensure scc compatibility with BoundServiceAccountTokenVolume 2021-07-02 09:53:56 UTC
Github openshift kubernetes pull 842 0 None closed Bug 1977924: [release-4.8] Ensure scc compatibility with BoundServiceAccountTokenVolume 2021-07-02 13:10:50 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 23:14:11 UTC

Description Sergiusz Urbaniak 2021-06-30 17:45:23 UTC
+++ This bug was initially created as a clone of Bug #1977920 +++

Description of problem:
A pod using a SA which has only access to an SCC with a specific (defined) set of volumes will fail to launch.

This is because 1.21 is moving to bound tokens which are using projected volumes.

Version-Release number of selected component (if applicable):


How reproducible:
Always 

Steps to Reproduce:
1. SA with custom SCC which has secrets + hostpath is set
2. Create pod with SA
3. Create pod

Actual results:
Pod fails to launch

CNV HPP fails to launch, see bug #1977179

Expected results:
Pod launches

Additional info:
This is addressed by adding th projected  volume to the custom SCC.
Hwoeveer, this is not possible in 4.7 as the volume type did not exist back then.

--- Additional comment from Fabian Deutsch on 2021-06-30 17:40:44 UTC ---

https://github.com/awels/hostpath-provisioner-operator/blob/master/pkg/controller/hostpathprovisioner/scc.go#L112 is an affected SCC

Comment 4 Xingxing Xia 2021-07-05 01:51:42 UTC
Besides the verification against fresh env, one more checkpoint needing to cover comes to my brain - upgrade testing:
In 4.7 fresh env, create SCC that keeps 'secret' but has 'projected' removed, then upgrade it to latest 4.8; after upgrade, test the SCC is added with 'projected'.

Comment 5 Xingxing Xia 2021-07-05 04:04:12 UTC
(In reply to Xingxing Xia from comment #4)
Update: after upgrade, not test the SCC is added with 'projected', rather, test if the app pod that depends on the SCC can be still run.

Comment 6 liyao 2021-07-05 10:33:06 UTC
Tested in cluster 4.8.0-0.nightly-2021-07-02-124716
1. create new SCC without 'projected' volume type
$ oc get scc hostaccess -o yaml > myscc.yaml
$ sed -i -e "/- projected/d" -e "s/hostaccess/myscc/" myscc.yaml
$ oc create -f myscc.yaml

2. add the new SCC to SA default
$ oc login -u testuser
$ oc new-project test
$ oc adm policy add-scc-to-user myscc -z default -n test --context admin

3. create pod and check whether pod can be launched successfully
$ cat > pod.yaml << EOF
apiVersion: v1
kind: Pod
metadata:
  name: testpod
spec:
  containers:
  - image: quay.io/openshifttest/hello-pod:latest
    name: testpod
    volumeMounts:
    - mountPath: /host
      name: myvolume
  volumes:
  - hostPath:
      path: /
    name: myvolume
EOF
$ oc create -f pod.yaml 
$ oc get pods -n test
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          26s


Tested after upgrade from 4.7.0-0.nightly-2021-07-03-010214
1. follow above test steps to create test pod using SCC without 'projected' volume type
$ oc get pods
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          12s

2. upgrade cluster
oc adm upgrade --to-image=registry.ci.openshift.org/ocp/release:4.8.0-0.nightly-2021-07-02-124716 --force=true --allow-explicit-upgrade=true

3. check whether testpod is still running
$ oc get pods
NAME      READY   STATUS    RESTARTS   AGE
testpod   1/1     Running   0          102m

Comment 7 Maru Newby 2021-07-07 17:51:05 UTC
No doc update required - this was a bug introduced and fixed in 4.8 prior to release.

Comment 9 errata-xmlrpc 2021-07-27 23:13:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.