opendevstack / opendevstack/ods-core

rolebinding admin lost when cloning environment

Open
#520 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
53
Forks
34
Avg merge
3h 26m
Merged PRs (30d)
1

Description

oc new-project <project-name> creates a role binding with name admin, for example (abbreviated):

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: admin
  namespace: autst-feature-16
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
  - kind: ServiceAccount
    name: jenkins
    namespace: autst-cd

When using oc apply the role binding named admin in rolebinding.yaml (exported from the cloned environment, here autst-dev) wins and replaces the role binding above.
This means jenkins itself no longer has admin provisions and fails fatally.

The import script is using oc create --save-config ... (https://github.com/opendevstack/ods-project-quickstarters/blob/17e530e7b623625bce38933c5ed242462cd7166e/ocp-templates/scripts/import_ocp_project_metadata.sh#L491) to avoid the issue above.

However, the existing rolebinding created by new-project is not overwritten. But the rolebinding named admin from rolebinding.yaml gets lost.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ocp-templates/scripts/import_ocp_project_metadata.sh around line 491 and inspect how it imports the cloned rolebinding.yaml. Reproduce the interaction between oc new-project and the import command, focusing on the two RoleBindings named admin. Done means the Jenkins admin binding created by the new project and the cloned environment's intended binding are both preserved correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, shell
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.