opendevstack / opendevstack/ods-core
rolebinding admin lost when cloning environment
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 53
- Forks
- 34
- Avg merge
- 3h 26m
- Merged PRs (30d)
- 1
Description
oc new-project <project-name> creates a role binding with name admin, for example (abbreviated):
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin
namespace: autst-feature-16
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: admin
subjects:
- kind: ServiceAccount
name: jenkins
namespace: autst-cd
When using oc apply the role binding named admin in rolebinding.yaml (exported from the cloned environment, here autst-dev) wins and replaces the role binding above.
This means jenkins itself no longer has admin provisions and fails fatally.
The import script is using oc create --save-config ... (https://github.com/opendevstack/ods-project-quickstarters/blob/17e530e7b623625bce38933c5ed242462cd7166e/ocp-templates/scripts/import_ocp_project_metadata.sh#L491) to avoid the issue above.
However, the existing rolebinding created by new-project is not overwritten. But the rolebinding named admin from rolebinding.yaml gets lost.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ocp-templates/scripts/import_ocp_project_metadata.sh around line 491 and inspect how it imports the cloned rolebinding.yaml. Reproduce the interaction between oc new-project and the import command, focusing on the two RoleBindings named admin. Done means the Jenkins admin binding created by the new project and the cloned environment's intended binding are both preserved correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, shell
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100