Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release-3.9] diagnostics: AggregatedLogging ClusterRoleBindings false negative fix #18888

Conversation

openshift-cherrypick-robot

This is an automated cherry-pick of #18641

/assign sosiouxme

The clusterRoleBindings check can output false alarm even if `cluster-reader`
role is assigned to fluentd service account and logging works as expected.

The check used to query for `cluster-readers` CRB, but the common command
`oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:logging:aggregated-logging-fluentd`
no longer appers to add the SA into `cluster-readers` group but instead
creates cluster-reader-1 CRB.

```
$ oc get clusterrolebindings cluster-readers -o yaml
...
roleRef:
  name: cluster-reader
...
userNames: null

$ oc get clusterrolebindings
NAME              ROLE            USERS  GROUPS                  SERVICE ACCOUNTS                   SUBJECTS
...
cluster-reader    /cluster-reader                                management-infra/management-admin
cluster-reader-0  /cluster-reader                                default/router
cluster-reader-1  /cluster-reader                                logging/aggregated-logging-fluentd
cluster-readers   /cluster-reader        system:cluster-readers
...
```

This fix queries all clusterrolebindings, iterates over those, that have
role `cluster-reader` and then validates there is a `cluster-reader` entry
for `system:serviceaccount:logging:aggregated-logging-fluentd`
@sosiouxme
Copy link
Member

/approve
/lgtm
/retest

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 8, 2018
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: openshift-cherrypick-robot, sosiouxme

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 8, 2018
@openshift-merge-robot
Copy link
Contributor

/test all [submit-queue is verifying that this PR is safe to merge]

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot
Copy link
Contributor

Automatic merge from submit-queue.

@openshift-merge-robot openshift-merge-robot merged commit 60c4264 into openshift:release-3.9 Mar 8, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants