OCPBUGS-65621: add dedicated service account to crb, cvo and version pod#1266
OCPBUGS-65621: add dedicated service account to crb, cvo and version pod#1266ehearne-redhat wants to merge 27 commits intoopenshift:mainfrom
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
WalkthroughThis change restructures the cluster-version-operator's RBAC configuration by introducing dedicated service accounts (cluster-version-operator and update-payload) in place of relying on the default service account, and binding these accounts to the necessary cluster-admin roles. Service account references are added to relevant pod and deployment specifications. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ehearne-redhat The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/retest |
|
/test e2e-aws-ovn-upgrade |
|
/test e2e-aws-ovn-techpreview |
|
/retest |
|
/retest |
ehearne-redhat
changed the title
openshift-ci-robot
added
jira/severity-critical
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65621, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65621, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ehearne-redhat: This pull request references Jira Issue OCPBUGS-65621, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
4 similar comments
|
/retest |
|
/retest |
|
/retest |
|
/retest |
|
/retest |
1 similar comment
|
/retest |
ehearne-redhat
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/test e2e-aws-ovn-techpreview |
|
/test okd-scos-images |
install/0000_00_cluster-version-operator_02_service_account.yaml
Outdated
Show resolved
Hide resolved
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: cluster-version-operator-1 |
There was a problem hiding this comment.
Redundant vs. the cluster-version-operator you declare down at the end of this file?
There was a problem hiding this comment.
Actually, this one is interesting. So, in order to get the into-change and out-of-change tests to pass, these two CRBs play different roles.
cluster-version-operator CRB is for the out-of-change test. It looks for this binding so it has the necessary permissions for the default service account to conduct itself.
cluster-version-operator-1 CRB is for the into-change test. This binding ensures the new service account cluster-version-operator has the necessary permissions to conduct itself.
Without cluster-version-operator CRB, the default service account appears to not have the necessary permissions and fail, probably because of the naming of the CRBs. This is important for the out-of-change test to pass.
| namespace: openshift-cluster-version | ||
| roleRef: | ||
| kind: ClusterRole | ||
| name: cluster-admin |
There was a problem hiding this comment.
Update-payload Pod doesn't make Kube API calls at all, so I don't think we need this cluster-version-operator-payload ClusterRoleBinding.
There was a problem hiding this comment.
I've commented it out to test this. If proves true in testing, I'll remove entirely.
| @@ -23,6 +23,7 @@ spec: | |||
| k8s-app: cluster-version-operator | |||
| spec: | |||
| automountServiceAccountToken: false | |||
| serviceAccountName: cluster-version-operator | |||
There was a problem hiding this comment.
Can you either add this to the bootstrap manifest too, or have a commit message that mentions why we don't need a service account for that bootstrap manifest?
In that vein, you might want to reshuffle your existing commit stack to try and tell the transformation story in a more narrative arc. It is completely fine to take a bunch of commits, if you need more space to talk about each pivot in a series. But at the moment, there are things like fc55fa5, which sounds like useful context to include in a "why I did things this way..." commit message in a commit that adds the new role-bindings. But I don't see a benefit to keeping it completely separate, vs. having a single commit that brings in the finished roll bindings and then explains all the context you need to explain that finished shape.
There was a problem hiding this comment.
I've added it to the bootstrap manifest. I'll wait to see how tests behave before squashing the commits into a narrative commit, or a collection of them depending.
|
/retest |
1 similar comment
|
/retest |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@install/0000_00_cluster-version-operator_03_roles.yaml`:
- Around line 31-45: The ClusterRoleBinding manifest is missing the required
roleRef.apiGroup field; update the ClusterRoleBinding (metadata.name:
cluster-version-operator) to add roleRef.apiGroup: rbac.authorization.k8s.io
alongside the existing roleRef.kind: ClusterRole and roleRef.name: cluster-admin
so the roleRef block is valid for Kubernetes RBAC (affecting the
ClusterRoleBinding that grants the ServiceAccount in namespace
openshift-cluster-version name default).
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: cluster-version-operator | ||
| annotations: | ||
| kubernetes.io/description: Grant the cluster-version operator permission to perform cluster-admin actions while managing the OpenShift core. | ||
| include.release.openshift.io/self-managed-high-availability: "true" | ||
| release.openshift.io/delete: "true" | ||
| roleRef: | ||
| kind: ClusterRole | ||
| name: cluster-admin | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| namespace: openshift-cluster-version | ||
| name: default |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Kubernetes ClusterRoleBinding roleRef apiGroup required schema
💡 Result:
For rbac.authorization.k8s.io/v1 ClusterRoleBinding, roleRef is required, and within it apiGroup, kind, and name are all required fields. roleRef in a ClusterRoleBinding can only reference a ClusterRole, and the roleRef is immutable (can’t be changed after creation). [1], [2]
Minimal schema (YAML shape):
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: <binding-name>
roleRef: # required
apiGroup: rbac.authorization.k8s.io # required
kind: ClusterRole # required (ClusterRoleBinding -> ClusterRole)
name: <clusterrole-name> # required
subjects:
- kind: User|Group|ServiceAccount
name: <subject-name>
namespace: <ns> # only for ServiceAccount
apiGroup: rbac.authorization.k8s.io # for User/Group (not used for ServiceAccount)
``` [1], [2]
**Key point:** `roleRef.apiGroup` is not optional—set it to **`rbac.authorization.k8s.io`** for RBAC Role/ClusterRole references. [1], [2]
Sources:
[1] Kubernetes RBAC reference / ClusterRoleBinding fields (roleRef + required subfields) ([dev-k8sref-io.web.app](https://dev-k8sref-io.web.app/docs/authorization/clusterrolebinding-v1/?utm_source=openai))
[2] Kubernetes RBAC docs (ClusterRoleBinding example; roleRef immutability) ([v1-32.docs.kubernetes.io](https://v1-32.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/?utm_source=openai))
Citations:
- 1: https://dev-k8sref-io.web.app/docs/authorization/clusterrolebinding-v1/?utm_source=openai
- 2: https://v1-32.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/?utm_source=openai
---
</details>
**Add missing `roleRef.apiGroup` to avoid invalid ClusterRoleBinding.**
The `roleRef` field omits `apiGroup`, which is a required field in the Kubernetes RBAC schema for ClusterRoleBinding. This omission will cause validation failures when the manifest is applied or schema-checked. Set it to `rbac.authorization.k8s.io`.
<details>
<summary>Proposed fix</summary>
```diff
roleRef:
kind: ClusterRole
name: cluster-admin
+ apiGroup: rbac.authorization.k8s.io📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: cluster-version-operator | |
| annotations: | |
| kubernetes.io/description: Grant the cluster-version operator permission to perform cluster-admin actions while managing the OpenShift core. | |
| include.release.openshift.io/self-managed-high-availability: "true" | |
| release.openshift.io/delete: "true" | |
| roleRef: | |
| kind: ClusterRole | |
| name: cluster-admin | |
| subjects: | |
| - kind: ServiceAccount | |
| namespace: openshift-cluster-version | |
| name: default | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: cluster-version-operator | |
| annotations: | |
| kubernetes.io/description: Grant the cluster-version operator permission to perform cluster-admin actions while managing the OpenShift core. | |
| include.release.openshift.io/self-managed-high-availability: "true" | |
| release.openshift.io/delete: "true" | |
| roleRef: | |
| kind: ClusterRole | |
| name: cluster-admin | |
| apiGroup: rbac.authorization.k8s.io | |
| subjects: | |
| - kind: ServiceAccount | |
| namespace: openshift-cluster-version | |
| name: default |
🤖 Prompt for AI Agents
In `@install/0000_00_cluster-version-operator_03_roles.yaml` around lines 31 -
45, The ClusterRoleBinding manifest is missing the required roleRef.apiGroup
field; update the ClusterRoleBinding (metadata.name: cluster-version-operator)
to add roleRef.apiGroup: rbac.authorization.k8s.io alongside the existing
roleRef.kind: ClusterRole and roleRef.name: cluster-admin so the roleRef block
is valid for Kubernetes RBAC (affecting the ClusterRoleBinding that grants the
ServiceAccount in namespace openshift-cluster-version name default).
|
@ehearne-redhat: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
What
openshift-cluster-versionnamespace.Why