Created attachment 1976390 [details] cnao rules Description of problem: With CNV-v4.14.0.rhel9-1274, for cluster-network-addons-operator we are seeing global permission set for one rule. Version-Release number of selected component (if applicable): CNV-v4.14.0.rhel9-1274 How reproducible: 100% Steps to Reproduce: 1. Check csv.spec.install.spec.clusterPermissions for cluster-network-addons-operator 2. 3. Actual results: { "apiGroups": [ "k8s.cni.cncf.io" ], "resources": [ "*" ], "verbs": [ "*" ] }, Expected results: No global permission rule for cluster-network-addons-operator Additional info:
https://github.com/kubevirt/cluster-network-addons-operator/pull/1587 should allow us to disable these excessive rules. This will require a follow-up downstream HCO patch setting a new flag on the manifest templator of CNAO.
Code on CNAO U/S and M/S has been merged. The last step is to update https://gitlab.cee.redhat.com/cpaas-midstream/openshift-virtualization/hco-bundle-registry/-/blob/cnv-4.14-rhel-9/distgit/containers/hco-bundle-registry/cnv-operators-csv-generator.py#L332-389
Verified against CNV-v4.14.0.rhel9-1491. The original issue reported has been fixed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: OpenShift Virtualization 4.14.0 Images security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:6817