Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release-4.17] OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2640

Open
wants to merge 3 commits into
base: release-4.17
Choose a base branch
from
Open

[release-4.17] OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs #2640

wants to merge 3 commits into from

Conversation

openshift-cherrypick-robot
Copy link

This is an automated cherry-pick of #2627

/assign ormergi

@ormergi
ovn-k,rbac: Add UDN to cluster-reader
4bcdc5b 
Enable non cluster-admin users read UserDefinedNetwork CRs.

Signed-off-by: Or Mergi <[email protected]>
@ormergi
ovn-k,rbac: Enable non-admin users create & modify UDN CRs
c18055f 
The UserDefinedNetwork (UDN) CRD is targeted for non cluster-admin (e.g:
project-admins) users enabling self-service OVN-K overlay networks
w/o the cluster-amdin intervention [1].

The existing "openshift-ovn-kubernetes-cluster-reader" cluster-role
doesn't affect all non-admin users in the cluster, requiring the admin to
grant cluster-reader permissions.

Add UDN reader cluster-role, utilizing cluster-role aggregation [2] to
add the permissions to the built-in "view" cluster-role.

Add UDN editor clsuter-role, utilizing cluster-role aggregation [2] to
add the permissions to the built-in "edit" cluster-role.

For completeness, add UDN read permissions to the existing cluster-role:
"openshift-ovn-kubernetes-cluster-reader"

[1] https://issues.redhat.com/browse/RFE-5530
[2] https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

Signed-off-by: Or Mergi <[email protected]>
@ormergi
ovn-k, units-test: Test OVN Kubernetes rendering
9eaa982 
Signed-off-by: Or Mergi <[email protected]>
Signed-off-by: Jaime Caamaño Ruiz <[email protected]>
@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Feb 4, 2025
Merged
@openshift-ci-robot
Copy link
Contributor

@openshift-cherrypick-robot: Jira Issue OCPBUGS-48443 has been cloned as Jira Issue OCPBUGS-49816. Will retitle bug to link to clone.
/retitle [release-4.17] OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs

In response to this:

This is an automated cherry-pick of #2627

/assign ormergi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot changed the title [release-4.17] OCPBUGS-48443: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs [release-4.17] OCPBUGS-49816: ovn-k, rbac: Enable users read & modify UserDefinedNetwork CRs Feb 4, 2025
@openshift-ci-robot openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Feb 4, 2025
@openshift-ci-robot
Copy link
Contributor

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-49816, which is invalid:

  • expected dependent Jira Issue OCPBUGS-48443 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead
  • expected dependent Jira Issue OCPBUGS-48443 to target a version in 4.18.0, but it targets "4.18" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This is an automated cherry-pick of #2627

/assign ormergi

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from abhat and dougbtv February 4, 2025 12:20
@tssurya
Copy link
Contributor

tssurya commented Feb 6, 2025

/assign @jcaamano

@ormergi
Copy link
Contributor

ormergi commented Feb 6, 2025

/jira refresh

@openshift-ci-robot
Copy link
Contributor

@ormergi: This pull request references Jira Issue OCPBUGS-49816, which is invalid:

  • expected dependent Jira Issue OCPBUGS-48443 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead
  • expected dependent Jira Issue OCPBUGS-48443 to target a version in 4.18.0, but it targets "4.18" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ormergi
Copy link
Contributor

ormergi commented Feb 6, 2025

/jira refresh

@openshift-ci-robot
Copy link
Contributor

@ormergi: This pull request references Jira Issue OCPBUGS-49816, which is invalid:

  • expected dependent Jira Issue OCPBUGS-48443 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ormergi
Copy link
Contributor

ormergi commented Feb 6, 2025

/jira refresh

@openshift-ci-robot
Copy link
Contributor

@ormergi: This pull request references Jira Issue OCPBUGS-49816, which is invalid:

  • expected dependent Jira Issue OCPBUGS-48443 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jcaamano
Copy link
Contributor

jcaamano commented Feb 6, 2025

/lgtm
/approve
/label backport-risk-assessed

@openshift-ci openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Feb 6, 2025
@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 6, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Feb 6, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcaamano, openshift-cherrypick-robot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 6, 2025
@ormergi
Copy link
Contributor

ormergi commented Feb 11, 2025

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Feb 11, 2025
@openshift-ci-robot
Copy link
Contributor

@ormergi: This pull request references Jira Issue OCPBUGS-49816, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.17.z) matches configured target version for branch (4.17.z)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
  • release note type set to "Release Note Not Required"
  • dependent bug Jira Issue OCPBUGS-48443 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
  • dependent Jira Issue OCPBUGS-48443 targets the "4.18.0" version, which is one of the valid target versions: 4.18.0
  • bug has dependents

Requesting review from QA contact:
/cc @anuragthehatter

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@asood-rh
Copy link

/label cherry-pick-approved

@openshift-ci openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Feb 12, 2025
@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

12 similar comments
@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD b0ce1c3 and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 58ddfcf and 1 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 58ddfcf and 2 for PR HEAD 9eaa982 in total

3 similar comments
@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 58ddfcf and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 58ddfcf and 2 for PR HEAD 9eaa982 in total

@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 58ddfcf and 2 for PR HEAD 9eaa982 in total

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Feb 20, 2025

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-hypershift-ovn-kubevirt 9eaa982 link false /test e2e-aws-hypershift-ovn-kubevirt
ci/prow/e2e-aws-ovn-single-node 9eaa982 link false /test e2e-aws-ovn-single-node
ci/prow/security 9eaa982 link false /test security
ci/prow/e2e-openstack-ovn 9eaa982 link false /test e2e-openstack-ovn
ci/prow/e2e-network-mtu-migration-ovn-ipv6 9eaa982 link false /test e2e-network-mtu-migration-ovn-ipv6
ci/prow/e2e-vsphere-ovn-dualstack-primaryv6 9eaa982 link false /test e2e-vsphere-ovn-dualstack-primaryv6
ci/prow/unit 9eaa982 link true /test unit

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@abhat abhat Awaiting requested review from abhat

@dougbtv dougbtv Awaiting requested review from dougbtv

@anuragthehatter anuragthehatter Awaiting requested review from anuragthehatter

Assignees

@mffiedler mffiedler

@rbbratta rbbratta

@eurijon eurijon

@jcaamano jcaamano

@ormergi ormergi

@anuragthehatter anuragthehatter

@huiran0826 huiran0826

@asood-rh asood-rh

@jechen0648 jechen0648

@qiowang721 qiowang721

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.